Mick Wallace (Wexford, Independent) | Oireachtas source

I move amendment No. 36:

In page 25, line 12, after “include” to insert “in particular the following”.

I will deal with a couple of the amendments and Deputy Daly will deal with the others. Amendment No. 36 is part of a bigger structural adjustment to this part of the Bill. The insertion of the phrase "in particular the following" is intended as an extra layer of precaution for what is one of the more important sections of the Bill in that it functions as what the Minister might call a toolbox for many other sections. Many other sections refer back to this section and the phrase "in particular the following" is used elsewhere in the Bill to stipulate extra protections or precautions, so it is not unreasonable to insist on its inclusion here. Amendments Nos. 37 and 38 depend on each other. The inclusion of the phrase "subject to suitable and specific measures" also appears many times in the Bill and points us back to section 35. Section 35 and the suitable and specific measures contained therein are important for the most part and are lifted from various parts of the GDPR, but the way section 35 is organised in the Bill renders optional very important aspects of data protection.

The issue of explicit consent is something we will come back to on section 45. I understand why explicit consent needs to be optional in section 35 as the GDPR provides for exemptions to explicit consent. As we understand it, the GDPR does not provide for exemptions with regard to section 35(1)(b) and (c). I do not understand why limitations on access to personal data that are processed in the workplace should not be a mandatory measure in section 35. The same applies to the issue of imposing time limits for the erasure of personal data and mechanisms to ensure these time limits are adhered to. The purpose of our amendments is to rearrange section 35, delete some of the so-called suitable and specific measures, such as explicit consent, which is a necessity of the GDPR, and to separate others as mandatory, hence the use of "shall" instead of "may" in page 26, line 14, in amendment No. 42.

I will skip some of the following amendments because Deputy Daly will deal with them. Amendment No. 43 should be taken together with amendment No. 47 to section 37. They are essentially the same amendment. The central point in this amendment is the requirement for the Minister to provide a written rationale should he or she proceed to introduce regulations that go against the advice of the data protection commission. The amendment was proposed by Senator Alice-Mary Higgins in the Seanad and it seems to me to be entirely reasonable. It seems sensible and entirely workable and appropriate that such a written rationale would be put before the Committee on Justice and Equality. I do not see how it would compromise the independence of the commission. The point is to ensure heightened accountability for the Minister when creating regulations.

There are a number of State projects about which the Data Protection Commissioner has concerns. The commissioner has opened a section 10 investigation into the public services card and the single customer view which is one of the biggest data sharing projects in the history of the State. It is almost unprecedented.

It is highly unusual and should set off alarm bells for the Government, yet the Department of Employment Affairs and Social Protection, which claims it is the data controller for the public services card project, continues to double down on the expansion of the project even though it knows that the coming into force of the GDPR is just around the corner. We have an example of the Department and the Minister ignoring the advice of the Data Protection Commissioner and ploughing on regardless.