Holly Cairns (Cork South West, Social Democrats) | Oireachtas source

I have a couple of questions and if there is time I will come back in with more depending on how long the answers are, if that is okay.

Head 40 sets out a list of requirements for when or if the Government wants to restrict GDPR rights. Is that compliant with Article 23 of the GDPR, which sets out when member states can make those exemptions? Is it permissible at present for the Department of Children, Equality, Disability, Integration and Youth to refuse people access to information about themselves on the basis that it also concerns a deceased person? Is it permissible at present for the Department of Children, Equality, Disability, Integration and Youth to refuse to give people's medical information directly to them and instead require people to hand over their doctor's details in order that the Department can speak to a doctor about whether they pose a risk to themselves?

Does the Bill attempt to stop GDPR operating in respect of all data controllers other than what the Bill refers to as the relevant bodies? They are currently proposed as the Adoption Authority of Ireland and Tusla. If that is the case, is that permissible under GDPR? Why should people not be entitled to request their data from whoever holds it, including the Department of Children, Equality, Disability, Integration and Youth and other private organisations under current GDPR provisions? The scheme does not provide a mechanism for adopted people involved in forced family separation to access the administrative files of institutions, agencies and individuals and a full range of the records held by State bodies and private entities concerning early life information.

I will start with those questions. If there is time, I will come back in with more.