Dáil Éireann Debate, Tuesday - 11 July 2023
472. Deputy Emer Higgins asked the Minister for Justice if her attention has been drawn to concerns (details supplied) regarding an amendment to the Courts and Civil Law (Miscellaneous Provisions) Bill 2022; and if she will make a statement on the matter. [33431/23]
View answerThe Courts and Civil Law (Miscellaneous Provisions) Bill 2022, which was signed by the President on 5 July 2023, makes a number of amendments to the Data Protection Act of 2018.
As the Deputy will be aware, section 67 inserts a new section 26A, into the Data Protection Act 2018 to provide a prohibition on disclosure of confidential information by persons engaged with the Data Protection Commission in connection with certain defined functions.
As Minister Browne outlined to the House, the purpose of this amendment is to bolster the integrity of the statutory processes and the provision to the Data Protection Commission of confidential and commercially sensitive information in the course of carrying out certain statutory functions. Under the GDPR the State has a duty to ensure the DPC is provided with the powers necessary for the effective performance of its tasks.
Section 26A (1) provides that the Data Protection Commission may issue a written notice to a person, known as a “relevant person”, where the Commission is or will be providing that person with confidential information, directing that the person not to disclose that information, unless required by law or authorised by the Commission.
The prohibition on disclosure does not however apply where disclosure of the confidential information is required or permitted by law, or authorised by the Commission in writing.
The notice must identify the information that is confidential and the specific reason why, with reference to the definition of confidential information in subsection 5, it is confidential.
‘confidential information’ is a defined term under section 26A (5) and there are three elements to it -
1. commercially sensitive information within the meaning of section 149(7),
2. information given in confidence and on the understanding that it will be treated as confidential and where, the disclosure of such information would be likely to prejudice the giving to the Commission of further information and it is important that the Commission continues to receive such information for the purpose of the performance of a relevant function,
or
3. information the disclosure of which could, in the opinion of the Commission, reasonably be expected to prejudice the effectiveness of the performance of a relevant function.
The amendment, and therefore the ability for the Commission to prohibit disclosure of confidential information, only applies in the context of “relevant functions” which are statutory investigations, inquiries, audits and handling of complaints under the Data Protection Act 2018.
There are also limits included in relation to the duration in which the obligation not to disclose information lasts. Where information is confidential because its disclosure would prejudice the effectiveness of the performance of a relevant function, that prohibition ceases once the relevant function has concluded.
Nothing in this amendment would prevent a person from speaking out about the nature of their data privacy complaint or that a complaint had been made to the Data Protection Commission.
It also has no impact on media reporting about complaints or the enforcement of the GDPR.
This was an amendment sought by the Data Protection Commission in support of its ability to carry out its functions under the GDPR in an effective, efficient and lawful manner and to ensure fair procedures are maintained for data controllers and data subjects alike.
