Charles Flanagan (Laois, Fine Gael) | Oireachtas source

Section 47 has been included to address a specific issue arising from the strict definition of consent included in the GDPR. The matter also arose during the preparation of legislation in a number of other member states, of which we are aware.

The matters referred to in section 47, paragraphs (a) to (d), inclusive, insurance or life assurance policies, pensions, annuities and mortgages, are normally the subject matters of a detailed contract between the data subject and an insurance company or a financial institution. In order to determine contributions, it may well require obtaining information on the health of the data subject, or his or her welfare or disposition. Article 6(1)(b) of the GDPR permits the processing of non-sensitive personal data.

Article 9.2 does not permit the processing of such personal data for contractual purposes. The question then is whether the explicit consent of the data subject in Article 9.2(a) provides a sufficiently robust ground for securing the benefits of such a contract. The difficulty that arise relates to the strict definition of "consent" in Article 4.11 of the GDPR. It prescribes that for the consent to be valid, it must be "freely given". Recital 43 states that consent should not provide a valid legal ground for the processing of personal data "where there is a clear imbalance between the data subject and the controller". My concern, which is shared by a number of other member states, is that the insurance company or financial institution may in certain circumstances, in the absence of this section, seek to resile from the contract with the data subject on the basis that the consent of the subject could not have been freely given. The need for the provision has been discussed and agreed with the Attorney General and I am not inclined, therefore, to accept the amendments.