Charles Flanagan (Laois, Fine Gael) | Oireachtas source

Sections 103, 107, 108, 109, 111, 120 and 121 deal with the complaints handling process, which is both streamlined and comprehensive. I will focus on the key amendments. As regards Deputy Ó Laoghaire's amendment No. 137 and Deputy O'Callaghan's amendment No. 138, both of which would replace section 107(1), I have a serious problem with the introduction of a discretion on the part of the commission not to investigate a complaint that is "frivolous or vexatious."

Amendments Nos. 139, 144, 159, 160, 164 would also allow the commission to decide not to investigate complaints on the basis that they were considered to be frivolous or vexatious. I am completely opposed to the introduction of this discretionary filter into the Bill for a number of reasons. First, it would not be compliant with the GDPR. Second, while the term "frivolous or vexatious" has a specific meaning in our law when used by the courts, that is, that the claim is unsustainable in law and is bound to fail, the term is not understood in other member states, except possibly in a common law jurisdiction such as the UK. On the contrary, to a data subject or a data protection authority in another member state, use of the word "frivolous" suggests that the matter is not regarded as sufficiently serious for investigation, while "vexatious" suggests that the complaint is seen as a deliberate intention to cause annoyance. The scope for such misunderstandings will be much greater under the "one-stop-shop" mechanism because the data protection commission will be acting as lead supervisory authority in many cross-border cases.

Unfortunately, the term "frivolous and vexatious" is used in section 10(1)(b) of the 1988 Act and it has created confusion and misunderstandings in recent years, especially in cross-border cases. In the Schrems judgment, Judge Hogan commented that the wording of that provision "is somewhat unfortunate and perhaps even unhelpful". Its use was widely misinterpreted and misunderstood in the aftermath of that case in which Mr. Schrems successfully contested the adequacy of the safe harbour mechanism. His original complaint concerning the shortcomings of the safe harbour mechanism had been rejected on the grounds that it was frivolous or vexations, that is, unsustainable in law because of the European Commission's decision to recognise the adequacy of privacy safeguards provided by the safe harbour mechanism.

The risk therefore of misinterpretation or misunderstanding will be very much greater in future because of the expected increase in the number of "one-stop-shop" cases handled by the data protection commission, which have originated in other member states. As I said, I cannot accept the alternative models put forward in the amendments to the complaints-handling mechanisms in Chapters 2 and 3 of Part 6. I ask for the understanding and support of the committee in the avoidance of any reference to the term "frivolous and vexatious". I believe that the robustness and effectiveness of the mechanisms outlined in Part 6 will be compromised by the introduction of a filter based on the commission's opinion as to whether a complaint it has received is "frivolous or vexations".

As regards amendments Nos. 140 and 161, a reference to consent of the parties is not required because an amicable resolution cannot take place without the consent of the parties in any event.

On section 108, I am not in favour of replacing reference to 107(5)(e) with a general reference to section 107(1) as proposed by amendment No. 147, where a complaint, following an examination by the commission under section 107(1), has been rejected or dismissed under 107(5)(a) or (b), a data subject has a specific right to appeal against that decision under section 148(a). Where the commission, following an examination of a complaint, has already issued an enforcement notice on the controller or processor in any of the situations referred to in section 107, the carrying out of a further inquiry would be unnecessary. The same applies where a data subject has been provided with advice by the commission, for example, where a data subject is seeking compensation and the commission explains that compensation remains a matter for the courts.

Amendments Nos. 149 and 170, which seek to insert new sections into the Bill, contain provisions that are taken from surrounding sections without deletion of those provisions. This would give rise to confusion and legal uncertainty. I cannot accept the amendments as drafted but I am happy to come back to them on Report Stage.The word "where" is correct and is consistent with usage throughout the Bill. I cannot accept amendment No. 171.

In summary, sections 107, 108, 120 and 121 of the Bill provide, in my view, a coherent and streamlined approach to the future handling of complaints by the Data Protection Commission and I am not disposed to accepting amendments that would militate against that coherence or streamlined frame that is envisaged under the Bill.