I propose to take Questions Nos. 643 to 645, inclusive, together.
These questions relate to specific provisions of the GDPR, the interpretation of that legislation and the Nowak judgement from the Court of Justice of the European Union.
Data protection responsibilities fall on the relevant data controller, and it is the data controller who is obliged to interpret and implement data protection requirements and responsibilities, in relation to the personal data that they hold.
Under the GDPR and Data Protection legislation, an individual can ask a data controller for their personal data held by the controller and I understand that the Nowak judgement gave further interpretation of the scope of ‘personal data’. However, I am aware that there can be constraints on the release of data, even where a person is deceased, as the rights of third parties may have to be taken into account.
The challenge posed by GDPR and data protection legislation, in relation to birth information, is that elements of that information can constitute shared personal data.
More widely, the Deputy may be aware of impact that GDPR is having on bodies locating individuals for the purposes of information and tracing. The current difficulties arise because of the absence of the necessary, sufficiently robust statutory basis for sharing of information in the context of information and tracing.
I am acutely aware of the complexity of the interface between GDPR and information and tracing, which by its nature involves the personal information of more than one individual. I am planning to address this issue in legislative proposals to establish the necessary statutory framework. The legal opinion forwarded by the Deputy will be taken into consideration in that context.