Clare Daly (Dublin Fingal, Independent) | Oireachtas source

Amendment No. 5, with consequential amendments Nos. 74 - which is not in this group for some reason - 96 and 111, to sections 48, 57 and 70 are absolutely crucial in our opinion. In discussing them, I will touch on some of the more controversial issues in this area. While my introductory remarks might be somewhat lengthy, that will not be repeated across the afternoon. I want to raise some general points now, which will save me from making them later, because they are key.

In all the debate around the Bill, the power of the Minister to make regulations after the fact, with no Oireachtas oversight, governing the processing of personal data or special categories of data, and restricting people's data rights has probably generated the most controversy, and is much more important than the age of consent in its implications.

At present, section 48 allows a Minister, or effectively a Department, to do the following: to designate some purpose - essentially anything - as being in the substantial public interest and make regulations allowing someone - presumably anyone - to take information about people's sexual orientation, sex life, political opinions, trade union membership and so on, as well as their genetic and biometric data and to do who knows what with it for the purpose of fulfilling some substantial public interest that we do not yet know about.

Section 57 proposes that the basic rights in the GDPR contained between Articles 12 to 22, and Article 34 can all be restricted for the purposes of what is called the general public interest. Section 57 contains a list of things relating to what the general public interest might be but it is not exhaustive and any Minister can designate by regulation basically anything as being in the public interest.

With regard to section 70 and the reason we tabled those amendments, let us look at section 48 as an example. This section allows for the processing of special categories of data such as health, sexual orientation and so on by whichever entity the Minister decides on for reasons of public interest so it could be, for example, that the Department of Employment Affairs and Social Protection decides it is going to create a database of people's ethnicity in order to combat fraud. It comes up with some sort of internal policy paper that links ethnicity and social welfare fraud and relates higher levels of fraud among some ethnic groups. The Minister then designates the prevention of social welfare fraud as being a substantial public interest and the Department comes up with regulations, gives a nod to the section, the Minister signs off and lo and behold, we have racial profiling and it is legal. A database is created about the riskiest ethnic groups who are targeted for invasive procedures. It might sound dramatic but that would be lawful at the moment.

I know the Minister will tell me that the provisions in subsection 5 would protect against this but there is a problem with that. The problem is the Irish State's record of data protection. We know it from the public services card and the primary online database. We know it not just from international problems but internationally. We must put this discussion in context. We do not have a good reputation for data protection. In 2015, the former German federal commissioner for data protection put it bluntly when he told The New York Timeswhy Internet businesses go to Ireland. He said:

Of course Facebook would go to a country with the lowest levels of data protection. It's natural they would choose Ireland.

We have also seen how our data retention regime has been the subject of significant legal issues going back more than ten years with Digital Rights Ireland cases; the constitutional challenge; having our data retention laws struck down in national constitutional courts in Germany, Bulgaria and Romania; the Tele2 case; and the Murray judgment. We must look at our record in this issue because the State continues to fight on it. Not only that, when we were presented with the Communications (Retention of Data) Bill as late as last year, it fell short of the Murray recommendations and the requirements in European law in the form of Tele2 and the European Convention on Human Rights so that is the context in which we must look at this Bill.

Our proven approach to this issue involves trundling along until we are forced by the European Court of Justice to derogate from that. Our proposal simply says that against this backdrop, and this is what all these amendments are about and we really see them as one of the most important bits, it is necessary that the Oireachtas has some kind of rules around the processing of the most sensitive types of data because that is what we are talking about. We need to have some democratic oversight and not a Civil Service free for all. Therefore, our very reasonable proposal is that when a Minister wants to make regulations under section 48 allowing the processing of the most sensitive kinds of data, they must ask the House to approve it. I do not think that is dramatic.

Our proposal in respect of section 70 is similar. That deals with the processing of sensitive data by competent authorities and other bodies specified in law for criminal justice purposes. The last section where we think this positive resolution procedure should apply is section 57. I mentioned earlier that section 57 allows for the restriction of rights under Articles 12 to 22 and Article 34 for what is called the general public interest. It lists 14 indicative objections of the general public interest. These are investigating ethics breaches in regulated professions, identifying assets derived from crime, ensuring the effective operation of immigration and so on. Look at the 14 objectives and in two seconds, one will be able to name the lobby group in each case which argued for the inclusion of its own objective in terms of this section. In the case of each of the 14, the Minister is allowed under the section to make regulations restricting rights under Articles 12 to 22 and Article 34. Under this section, any Minister is also allowed to designate new objectives as being of general public interest. All of this restricting and designating will take place behind closed doors with no democratic oversight or accountability. This section essentially means that Government Departments will be the judges of what rights individuals should have against them and their agencies without any need for legislation. These are rights people have by right under European law and the GDPR.

When we were here during pre-legislative scrutiny, the chair of Digital Rights Ireland, Dr T.J. McIntyre, put forward the idea of a positive resolution being necessary before any regulations are passed in the more controversial sections as one of the ways to mitigate against many of the wrongs in this Bill. This is exactly what we are doing with this group of amendments. At a previous meeting of the committee, Simon McGarr said, "I do not think we should allow for an unqualified right of a Minister to provide for exemptions from European law at the stroke of a pen by way of a statutory instrument regardless of whether that is attractive to the Executive as a method of providing for regulatory activity." Contrary to how much of the media focus has been around this Bill, this is actually one of the key provisions in it and we take it very seriously, which is why I took the extra time in making my introductory remarks.