Mr. Dale Sunderland:

I thank the committee for the invitation to contribute once again to its continuing scrutiny of the general scheme of the birth information and tracing Bill. I acknowledge the important and sensitive public policy issues at play here and I am happy to contribute to these deliberations.

Since our last appearance before the joint committee in July, we have continued to engage with the Department of Children, Equality, Disability, Integration and Youth on the matters raised in our preliminary observations on the general scheme of the Bill, which we presented to the committee in July and discussed at that time.

As the Chairman has noted, we were able to inform members at the July meeting that we had been provided by the Department with a copy of a data protection impact assessment as part of the statutory consultation process under Article 36 of the GDPR. We have subsequently been in a position to consider the DPIA in full and to provide some observations to the Department. Our overall general comment and view is that the DPIA represents a considered approach to identifying and mitigating any risks to the personal data of individuals arising from the operation of the Bill’s provisions, both in terms of those making requests under the Bill and receiving data and those other persons and third parties to whom these data might relate.

In broad terms, the DPIA sets out the scope of personal data processing required by the legislation and describes the processing operations and any proposed data sharing. It also contains an assessment of the necessity and proportionality of data processing in the context of the Bill and identifies risks and evaluates possible solutions and mitigations for those risks. We are informed by the Department that the DPIA remains under review, which is good practice, as the drafting of the Bill progresses and as ongoing stakeholder engagement takes place regarding the operational aspects of the proposed legislation.

In our previous submissions to the joint committee, we also highlighted the importance of clear guidelines detailing how the legislation is intended to operate in practice for the purpose of providing clarity and certainty to the various bodies such as the Adoption Authority of Ireland, Tusla and various other stipulated organisations that will act as data controllers for the purposes of the legislation. The DPC understands that the Department has commenced a stakeholder consultation on the development of those guidelines and we in the DPC remain available, through our supervision and consultation functions, to input guidance during that process, if requested to do so.

At our previous attendance before the joint committee, we also discussed a concern regarding the disclosure of medical information of birth relatives on the basis of an assumption that the data had been anonymised. I can inform the committee that the Department has taken on board our concerns and it is now accepted that this information should not be considered as being anonymous when processed by any of the various data controllers. It should be treated as special category personal data, that is, data concerning health at all stages of processing up until disclosure to the relevant person. This is an important clarification, as it will facilitate an approach that will provide medically or genetically relevant information to adopted persons in a manner where suitable safeguards apply and it is in the interests of all parties concerned that the data would be treated as personal data and subject to the full protections of the GDPR.

On a related note, at the July meeting of the joint committee a reference was made to the Data Protection (Access Modification) (Health) Regulations 1989 in terms of the release of medical information. We are aware that a process to replace these regulations has been commenced by the Department of Health under section 60(5)(a) of the Data Protection Act 2018 and we have been formally engaged in consultation as part of that process, which is at its early stages at this point. We welcome this development and recommend that the Department of Children, Equality, Disability, Integration and Youth should take account of the development of these replacement regulations in any further reworking of the provisions of this Bill regarding the release of medical information. In other words, those sections of the Bill that refer to the release of medical information should evolve as the Department of Health updates that 1989 statutory instrument to modern-day requirements and to a more suitable set of regulations to meet the context for which they are necessary today, as opposed to perhaps in 1989.

One of the principal areas of concern raised by the DPC in our preliminary observations on the general scheme of the Bill was the broad approach adopted in head 40 to the restriction of data subject rights. I can inform the joint committee that the Department has accepted the DPC’s concerns and has committed to conducting an in-depth analysis of the circumstances in which specific rights may be restricted, including the necessity and proportionality of such restrictions, which will underpin the ongoing development of the legislation. We welcome this approach, which aligns with our published guidance note, Limiting Data Subject Rights and the Application of Article 23 of the GDPR, which also aligns with the recently published guidelines of the European Data Protection Board.

I hope that these comments will be of assistance to the joint committee and I am very happy to answer the questions members may have and I thank the Chairman.