Clare Daly (Dublin Fingal, Independent) | Oireachtas source

I move amendment No. 1:

In page 11, between lines 19 and 20, to insert the following:“ “scientific research purposes” means scientific research carried out by research staff who have full autonomy in determining both the object of study and the methods of inquiry;”.

Section 39 provides general permission for the processing of personal data for a range of what might be called historical purposes, subject to suitable and specific measures being taken to safeguard the data, which measures are outlined in another section. Section 51 takes that slightly further, saying that so long as the processing is necessary and proportionate and also subject to suitable and specific measures, special categories of personal data, which we are going to be discussing a lot, about ethnic origin, political opinions, health, sexual orientation and so on, can be processed for research, historical and archiving purposes. What these sections mean at the most basic level is that using someone's data without his or her consent for research or scientific purposes is allowed. Section 58 then restricts the type of research or archiving processes. Some of the rights that people have in regard to their own data under the GDPR, for example, may be the right to have inaccurate data about them corrected, the right to object to processing and so on. In general, all that is fine because there are strong public interest reasons for doing research and archiving. Certainly in the case of archiving, it may literally be impossible to get consent because the data involved may belong to somebody whose whereabouts are not known.

However, there is a slight concern that "scientific research purposes" are not defined in the Bill. In other countries, Germany for example, there is a tradition of requiring research to be completely independent of any corporate influence in order to be considered scientific. Independence is generally understood as the research staff having full autonomy in determining both the object of the study and the methods of inquiry. In Germany, therefore, corporate research and analytics are unlikely to constitute "scientific research" within the meaning of the GDPR.

Our concern is that, particularly in the context of very sophisticated multinationals operating in Ireland, while we do not have this traditional understanding of scientific research, we do have a traditional deference to multinationals. This could give rise to a broad interpretation of what "scientific research" constitutes. Particularly because we are talking about the most protected types of personal data, we have to make sure this does not happen.

We think this is a small amendment. We want to make sure the data being exempted in these circumstances are being used for truly scientific purposes, in order to serve the public interest and make the world a better place. In such cases, using data without permission is fine. However, if data are being used with a view to manipulating us more efficiently through marketing dressed up as scientific research, I do not think it should be included. We think it is a minor amendment but very important nonetheless.