Mr. Dale Sunderland:

The way I would come at that in the context of the right of access is via the concept of mixed data. While it is not referenced in the GDPR, it is a reality that comes into play in scenarios where a birth certificate contains information about more than one person. The rights of the other person have to be taken into account. One cannot say that a person cannot have access to one's own data because there is an equality of rights for both data subjects. This is what Article 15.4 is also trying to get around in order to ensure that there is some mechanism by which the risk of an adverse impact on another person is taken into account. In the context of the proposed Bill, as we understand it, the constitutional requirements and also commitments given to mothers in the past all have to be taken into account in trying to strike the right balance. That is what the proposed Bill is trying to achieve. It is trying to avoid adverse impacts and that section of the Article 15 requires that balancing test to be conducted. That is the context in which I would view it. An individual cannot tell a data controller that he or she must never release anything about that individual, even if it is contained in a birth certificate. The controller has to look at that in the round. The controller will consider the wishes of the individual, determine whether there are adverse impacts and then decide if the provision under Article 15.4 restricts in any way the right of access. Some of these issues should be developed further under head 40, where there are other restrictions being imposed including, for example, restrictions related to the rights of third parties. If there is an intention to restrict their data subject rights, that will have to be fully addressed, explained and worked out in the proposed Bill under head 40.