Dr. T.J. McIntyre:

On the first part of the question, the Deputy is absolutely right that this kind of measure requires a DPIA under Article 35 of the GDPR. In addition, it requires prior consultation with the DPC under Article 36. On top of that, there are extra obligations under the law enforcement directive that was implemented into Irish law by section 84(12) of the Data Protection Act 2018, which also requires prior consultation. As we have seen, none of these requirements have been met and in fact Digital Rights Ireland has already written to the DPC about that.

I turn to a second point touched on by Deputy Costello, and raised previously by Deputy Pringle, regarding the Sinn Féin funds case principle and the issues this legislation raises in that regard. Committee members will recall that the Sinn Féin funds case concerned the question of interference by the Legislature in ongoing civil litigation and the extent to which that was permissible. In this context, Digital Rights Ireland is the party to some of that litigation. Therefore, I will not say much about this case, except to note that it is very unlikely that this legislation will retrospectively legitimise the retention of data that has already been retained. That ship sailed quite some time ago. It will be very unlikely, be it in the context of litigation such as the Digital Rights Ireland case or future challenges to the admissibility of criminal legislation, that the adoption of this legislation will retrospectively validate what happened before it. In that sense, one can take it that such a problem cannot be retrospectively fixed. This point was expressly made by the European Court of Justice in the Dwyer case, which stated that member states cannot limit the retrospective effect of findings of illegality under European law. If one tried to apply what is being proposed retrospectively, one would be doing it in a way that would contravene the principle outlined in the Dwyer case. Hopefully that answered Deputy Costello's question as it was addressed to me.