Mick Wallace (Wexford, Independent) | Oireachtas source

I move amendment No. 136:

In page 86, between lines 18 and 19, to insert the following:

“Rights under Article 80(1)106. (1) In addition to the rights conferred on a data subject under Article 80(1) to mandate a not-for-profit body, organisation or association to which Article 80(1) applies to lodge a complaint on his or her behalf with the Commission and, under section 15(7) to take a data protection action on behalf of the data subject, a not-for-profit body, organisation or association to which Article 80(1) applies may, independently of a data subject's mandate, and if it considers that the rights of a data subject under a relevant enactment have been infringed as the result of the processing of personal data in a manner that fails to comply with a relevant enactment, take the following actions on behalf of a data subject:

(a) lodge a complaint with the Commission under section 107;

(b) exercise the rights referred to in section 115 and section 148.

(2) Where the Commission or a court, in performing its functions under this Act, has reasonable doubts as to whether a particular body, organisation or association is one to which Article 80(1) applies, it may request the provision by the body, organisation or association concerned of such additional information as is necessary in order to confirm that it is such a body, organisation or association.”.

Deputy Clare Daly was supposed to speak to amendment No. 136. I would like to speak to amendments Nos. 155 to 158, inclusive. Section 115(7) of the Bill as drafted permits not-for-profit bodies such as, for example, Digital Rights Ireland, to bring an action on behalf of a data subject when it has been mandated by the data subject to do so. However, as argued by Dr. T.J. McIntyre during the pre-legislative scrutiny process, the Bill should provide that not-for-profit bodies also be allowed to independently bring actions without their having to be mandated by an individual data subject to do so. Amendment No. 155 seeks to remedy this. Perhaps the Minister of State, Deputy Breen, will explain why the Bill excludes this as I understand Article 80 includes this possibility as a discretionary provision, although in such cases compensation for damages would not be awarded unless the Article 80 body was specifically mandated by a data subject to bring the action.

Amendment No. 156 is an attempt to address the lack of provision in the Bill for a not-for-profit body of the type described in Article 80 of the GDPR, for example, Digital Rights Ireland, to bring an action for compensation for damages on behalf of a data subject. I do not understand why this is prohibited. Dr. T.J. McIntyre made a compelling case for it during the pre-legislative scrutiny phase. He said that, without it, there would be a gap in protection for data subjects. We must remember that when a data subject seeks to take a case for a data breach or violation of his or her data rights, he or she would in many instances be forced to discuss sensitive personal data publicly. Therefore, many people would be reluctant to come forward and become the public face of an issue. There is also the fact that many, if not most, individuals affected would not have the financial ability to bring an action themselves. Class actions are not permitted in Ireland as of yet. If a large number of people are affected by a single data breach, it makes sense on a practical level that they could be represented by a single Article 80 body instead of them taking cases individually, which the courts would not be equipped to handle. Surely it would make sense that Digital Rights Ireland, for example, should be allowed to act on behalf of such people if it is mandated to do so, as the GDPR permits, without taking the possibility of compensation off the table for complainants.