Dáil Éireann Debate, Wednesday - 30 May 2018
115. Deputy Donnchadh Ó Laoghaire asked the Minister for Justice and Equality the timeframe for the commencement of section 30 of the Data Protection Act 2018; the issues surrounding the delay on the commencement of the section including legal advice; and if he will make a statement on the matter. [23927/18]
Amharc ar fhreagraDuring discussions on section 30 in the Select Committee, and once again during Report Stage discussions, I pointed out that the processing of personal data for marketing and profiling purposes takes place under the so-called “legitimate interests” ground in Article 6.1(f) of the GDPR, and that the Court of Justice had already addressed the issue of whether national law could impose additional conditions on processing carried on under the corresponding provision of the 1995 Data Protection Directive in Joined Cases C-468/10 and C-469/10. In its ruling, the Court of Justice had underlined the importance of free movement of personal data under the 1995 Directive and concluded that Member States were not permitted to impose additional conditions that would have the effect of amending the scope of any of the grounds in Article 7 of the Directive. Those grounds are now set out in Article 6.1 of the GDPR.
The Office of the Attorney General has now advised my Department that insofar as section 30 purports to make it an offence for any company or corporate body to process the personal data of a child for the purposes of direct marketing or profiling, such a prohibition appears to go beyond the margin of discretion afforded to Member States in giving further effect to the GDPR and would conflict with Article 6(1)(f), read in conjunction with Recital (47). Put simply, it is not an option for a Member State to unilaterally prohibit a category of processing activities which might otherwise be lawful under Article 6.1(f). Since commencement of section 30 could, therefore, give rise to a substantial risk of infringement proceedings against the State pursuant to Article 258 of the Treaty on the Functioning of the European Union, I have requested my Department to clarify the matter with the European Commission.
Apart from this apparent conflict with the GDPR, the Office of the Attorney General has pointed out that section 30 gives rise to difficulties under Article 38.1 of the Constitution and under Article 7 of the European Convention on Human Rights. Article 38.1 provides that no person shall be tried on any criminal charge save in due course of law. In order for a domestic offence provision to comply with Article 38.1, it must be clear, precise and foreseeable in its application. This is not the case here since it is not clear what might constitute the processing of personal data of a child for the purposes micro-targeting. Whereas the GDPR refers to both direct marketing and profiling, the concept of micro-targeting does not appear in the GDPR and its scope remains uncertain and undefined. It is also a requirement under Article 7 of the Convention that offence provisions must be sufficiently clear and precise so as to enable individuals to ascertain which conduct constitutes a criminal offence and to foresee the consequences of engaging in such conduct.
Notwithstanding the difficulties concerning section 30, the Deputy will be aware that I have made provision in section 32 for the drawing up of codes of conduct intended to contribute to proper application of the GDPR with regard to the processing of the personal data of children for the purposes of direct marketing and creating personality and user profiles. I regard the drawing up of such a code as an urgent priority and I urge all relevant stakeholders, including bodies that represent the interests of children, to support that objective and to make appropriate input into its development and implementation.
