Dáil Éireann Debate, Tuesday - 11 July 2023
50. Deputy Pa Daly asked the Minister for Justice to provide an update related to section 67 of the Courts and Civil Law (Miscellaneous Provisions) Bill 2022, including an outline of the rationale behind the amendment’s inclusion in the Bill; and if she will make a statement on the matter. [33989/23]
View answerWill the Minister of State provide an update on section 67 of the Courts and Civil Law (Miscellaneous Provisions) Bill 2022, including an outline of the rationale behind the inclusion of an amendment in the Bill, and will he make a statement on the matter?
I thank the Deputy for raising this important matter. The Courts and Civil Law (Miscellaneous Provisions) Bill 2022, which was signed by the President on 5 July 2023, makes a number of amendments to the Data Protection Act 2018. As the Deputy will be aware, section 67 inserts a new section 26A into the Data Protection Act to provide a prohibition on disclosure of confidential information by persons engaged with the Data Protection Commission, DPC, in connection with certain defined functions. The purpose of this amendment is to bolster the integrity of the statutory processes and the provision to the DPC of confidential and commercially sensitive information in the course of carrying out certain statutory functions. Under the GDPR, the State has a duty to ensure that the DPC is provided with the powers necessary for the effective performance of its tasks.
Section 26A(1) provides that the DPC may issue a written notice to a person, known as a "relevant person", where the commission is or will be providing that person with confidential information, directing that the person not to disclose that information unless required by law or authorised by the commission. The prohibition on disclosure does not, however, apply where disclosure of the confidential information is required or permitted by law or authorised by the commission in writing. The notice must identify the information that is confidential and the specific reason it is confidential, with reference to the definition of "confidential information" in subsection (5).
The amendment, and therefore the ability for the commission to prohibit disclosure of confidential information, only applies in the context of relevant functions, which are statutory investigations, inquiries, audits and the handling of complaints under the Data Protection Act. There are also limits included in terms of the duration for which the obligation not to disclose information lasts. Where information is confidential because its disclosure would prejudice the effectiveness of the performance of a relevant function, that prohibition ceases once the relevant function has concluded.
Nothing in this amendment would prevent a person from speaking out about the nature of his or her data privacy complaint or that a complaint had been made to the DPC. It also has no impact on media reporting about complaints or the enforcement of the GDPR.
Additional information not given on the floor of the House
This was an amendment sought by the DPC in support of its ability to carry out its functions under the GDPR in an effective, efficient and lawful manner and to ensure fair procedures were maintained for data controllers and data subjects alike.
I thank the Minister of State for his reply. If someone breaches confidentiality after a direction is given, he or she is liable to a class A fine. Thankfully, there is still no offence on indictment, but this still threatens an inequality of arms, as many ordinary people, or even activists who are interacting with the DPC, will not be in a position to pay such a fine.
The amendment has created a great deal of concern among privacy and transparency activists. It is their view that the commission already uses its powers to direct non-disclosure far too liberally. According to the Government, the intent behind the law is to protect data given to the commission rather than to give the commission the ability to declare proceedings confidential. On a reading of the amendment, however, the powers are radical in that they set aside the intent or the context where the commission argues doing so is necessary in a case.
The amendment was sought by the Data Protection Commission in support of its ability to carry out its functions under GDPR in an effective, efficient and lawful manner and to ensure fair procedures are maintained for data controllers and data subjects. I will give an example. The Data Protection Commission will, from time to time, need to engage with parties other than the entity whose processing is under examination. For example, to enable complainants and, in some circumstances, representative bodies that may have referred matters of concern to the Data Protection Commission to exercise their right to be heard or to express their views on the matters under examination, it is important that the Data Protection Commission is able to share relevant material with those parties. The material that might need to be shared will depend on the circumstances of each individual inquiry but may include drafts of Data Protection Commission decisions as well as information and material that might have been received from the data controller or processor under examination. It is important that the Data Protection Commission is able to share this material with those parties but on a confidential basis to ensure it is retained as confidential.
As I said in a debate on legislation in recent weeks, I have sympathy for the Data Protection Commission in that it is under-resourced and, at some stages, it seems deliberately so. I also note the Government increased funding to the Data Protection Commission long after we in Sinn Féin made provision for doing so in our alternative budget under Deputy Martin Kenny two years ago.
It is very important that people who are seeking information have to be able to explain and outline the nature of the commission's decisions. Acts that now just disobey a directive will soon turn into criminal cases. Under section 154 of the 2018 Act, officers and the commissioner enjoy a defence of acting in good faith. This means that no proceedings can be brought against them. This an important protection that will allow them to do their job but it contrasts badly with the amendment the Government rammed through last week.
As I outlined, this will protect very particular information that is given in confidence, in line with the relevant functions of the Data Protection Commission. It is very important that the Data Protection Commission can carry out its duties under GDPR in compliance with EU law in a safe manner that can protect the information provided to it through its audits, investigatory powers or any of its other functions. To have a situation where anything provided to the Data Protection Commission will simply be available to the public would seriously hinder the Data Protection Commission in being able to carry out its role as required under the law.
