Charles Flanagan (Laois, Fine Gael) | Oireachtas source

Of the 12 amendments in the group, six are in my name. The purpose of section 57 is to protect the public and other objectives of general public interest. I state categorically that it does not restrict, nor will it be used to restrict, the data protection rights of citizens. For example, the Medical Council or the Property Services Regulatory Authority may have good reason to investigate a doctor or estate agent on foot of a complaint by a patient or client alleging unfitness to practice or otherwise. If the data protection rights of the individuals in question are not restricted on a temporary basis while the complaint is investigated, the doctor or estate agent could apply to have his or her data rectified, restricted or erased in certain circumstances. Any of these actions would put pay to an investigation, which would be to the detriment of the complainant and the regulatory body charged with supervision.

Regulations made under this section will permit regulatory bodies to carry out their statutory obligations to conduct inquiries or investigate complaints in the knowledge that those being investigated will not be permitted to exercise data subject rights in a manner that could jeopardise the regulatory body's performance of its statutory functions. Persons under investigation will not be permitted to exercise rights to rectification or erasure of their personal data while the investigations are ongoing. I say this against the background of the importance of meeting the conditions set out in Article 23 of the general data protection regulation in the text of section 57.

Subsections (1) and (2) give effect to the introductory text of Article 23.1 of the GDPR. Subsection (3) restricts the exercise of data subject rights. These are important issues and include Cabinet confidentiality and parliamentary privilege. We need to be mindful of many examples, including in the context of protected disclosures and other whistleblowing activity.

Amendment No. 86 is a drafting amendment that substitutes revised text for subsection (2). Amendment No. 87 removes reference to judicial independence and court proceedings from subsection (3)(a)(i), while amendments Nos. 194 to 196, inclusive, make more detailed provision for restrictions on the exercise of data subject rights in the case of courts acting in their judicial capacity. Amendment No. 89 inserts reference to the Comptroller and Auditor General alongside the Data Protection Commission and Information Commissioner. This will protect investigations and inquiries undertaken by the Comptroller and Auditor General in the performance of his or her constitutional and statutory functions.

As regards other amendments, my position is as follows. While I cannot accept amendment No. 85, which is not in line with Article 23 of the GDPR, I can accept amendment No. 88 tabled by Deputies Clare Daly and Mick Wallace. Amendment No. 90 is unnecessary in light of the requirement in subsection (10) that any regulations must "respect the essence of the right to data protection and protect the interests of the data subject". I cannot accept amendment No. 91, which seeks to delete subsection (5)(b), nor can I accept amendment No. 92, which seeks to limit the scope of "important objectives of general public interest" contrary to Article 23.1(e) of the GDPR. As regards amendment No. 94, it repeats the content of the existing subsection (8) and paragraph (b) duplicates the content of subsection (11). For these reasons, I cannot accept the amendment. I will accept amendment No. 95.

Amendment No. 97 would, if accepted, breach the GDPR insofar as the controller or processor is responsible for carrying out impact assessments. This is not a task for the data protection authority, not least because it would erode the authority's independence, which is important in the context of the legislation. As I stated in respect of section 48, the cumulative effect of the provisions proposed would be excessive and disproportionate. The making of regulations could take six, eight or nine months or perhaps longer. There are circumstances in which we would find that to be less than acceptable. In view of the issues I have outlined, I will not accept amendment No. 97.