Mr. Dale Sunderland:

I thank the committee for the invitation to appear before it and for facilitating contributions from the DPC on the committee's discussions, assessment and deliberations on the general scheme of the Bill. I am one of the deputy commissioners at the DPC with responsibility the commission’s supervision, guidance and international affairs functions. My colleague, Mr. David Murphy, assistant commissioner, supervision section, is also in attendance.

By way of general observation, the DPC notes that the broad intention of the draft heads of the Bill is to provide "relevant persons" aged 16 or over with access to a range of records and information, including their birth certificate, early life information, care information and medical information. The 1998 ruling of the Irish Supreme Court in I.O'T v. B and the Rotunda Girl’s Aid Society, and MH v. Rev GD and the society found that neither of two constitutional rights – the right to know about one's origins on the one hand and the right to privacy on the other – were absolute and that each might be constrained by the weight of the other, as well as the weight of the common good. That has resulted in the past, and still results, in a position where agencies in Ireland tasked with providing access to birth and early life information of adopted persons have had to do their best on a case-by-case basis to balance the competing rights in the cases on hand.

The DPC notes the Government's intention to propose legislation to the Oireachtas codifying how the balancing of these non-absolute rights should be achieved with a start and end point in favour of the right to identity information. The DPC considers that it is important in the context of this Bill that clear articulation is given to the proposed policy position to be adopted in favour of providing birth certificates to relevant persons aged over 16 without any process allowing for objection by a birth parent. An example of such an objection could be on the grounds that it would seriously harm him or her. Given that the previous iteration of this Bill outlined such a process, it is important that there is clarity around the policy change and why the balancing of rights in these sensitive situations is now deemed to have changed in favour of an absolute right to identity data. To be clear, the DPC does not advocate for either position. We are simply pointing out that data protection and privacy issues arise and the State must be able to articulate how it has come to the policy position and what considerations underpin the balancing of rights presented in the Bill.

With regard to the balancing of rights, it is clear that Article 15 of the general data protection regulation, GDPR, which provides the right of access to personal data, is not absolute. Article 15.4 states that the right to obtain a copy of personal data shall not adversely affect the rights and freedoms of others. That underlines the need for the Department, Government and Oireachtas to be clear in the context of the Bill as to how the rights and freedoms of the birth mother are not adversely affected to the extent they would restrict the right of access of the individual to information about his or her identity.

To be of assistance to the work of the committee, appended to my opening statement are the preliminary observations of the DPC on the Bill, as provided to the Department of Children, Equality, Disability, Integration and Youth. Those observations address the balancing of rights in addition to other data protection considerations such as the importance of transparency, the difficulties in treating data, including medical data, as anonymous in this context, and the limitation or restriction of rights provided under GDPR. The Department has responded positively to the DPC’s observations and has committed to further addressing the matters raised.

As part of the consultation process, we yesterday received a copy of a data protection impact assessment, DPIA, from the Department but we have not yet had the opportunity to assess it. I cannot, therefore, give the committee the view of the DPC as to whether the DPIA satisfactorily addresses all the data protection issues that arise. The DPIA provides an opportunity for the Department to interrogate the proposed processing of personal data in depth in terms of its justification on the basis of necessity and proportionality, in particular the balancing of the right to access to identity on the one hand, and data protection and privacy rights on the other.

It also provides an opportunity to identify and mitigate any data protection risks that arise. We note that many of the operational aspects of the Bill will be left to the formulation to be decided in guidelines., including the conduct of the tracing function. Again, the DPIA process is the mechanism by which the formulation of those guidelines can be informed and consideration given to all the necessary data protection policies and measures, including technical and organisational measures required to ensure compliance with data protection law. I will finish there. I hope these comments will be of assistance to the committee. I am happy to take any questions members may have.