Dara Calleary (Mayo, Fianna Fail) | Oireachtas source

I thank the Chairman and members for facilitating the discussion of the draft statutory instruments today. I know the committee has a busy work programme so members' time is appreciated. I am joined by Ms Tara Keane and Ms Orla O'Brien from my Department and I thank them for their work on this issue.

I understand a briefing note has been circulated so I will begin by setting out further background to the draft instruments for the three bodies. The Competition and Consumer Protection Commission, the Corporate Enforcement Authority and the Irish Auditing and Accounting Supervisory Authority each perform important statutory functions which can lead to a range of enforcement activities. They are a vital part of a robust regulatory framework that is responsive and reflects international best practice to facilitate enterprise and entrepreneurship while also protecting employees, members, creditors and consumers with appropriate safeguards.

All three statutory bodies have the power to take civil court proceedings or adopt administrative measures in certain circumstances to enforce the law in the public interest. In addition, the bodies work closely with each other and other regulatory and enforcement authorities in Ireland and within the EU that have administrative and civil enforcement powers. The Government is committed to ensuring that each body has the requisite legislative powers and resources to exercise their functions effectively. Members of the committee are aware of the establishment of the Corporate Enforcement Authority as a stand-alone statutory body in July this year and the enhanced powers introduced for the Competition and Consumer Protection Commission in the Competition (Amendment) Act 2022. The Irish Auditing and Accounting Supervisory Authority powers were also enhanced most recently in the Companies (Statutory Audits) Act 2018.

When the General Data Protection Regulation was introduced in 2018, it strengthened the rights of individuals in respect of the privacy and fair use of their personal data. It also introduced a balancing provision under Article 23 to ensure that this did not undermine the statutory functions of public bodies. Accordingly, section 60 of the Data Protection Act 2018 provides that the statutory instruments we are considering today may be introduced to protect important objectives of general public interest. Examples of the objectives specified in the Act and included in the draft instruments are avoiding obstructions to any official or legal inquiry; taking any action for the purpose of considering and investigating a complaint made to a regulatory body in respect of persons carrying out a profession or other regulated activity; and preventing, detecting, investigating or prosecuting breaches of the law that are subject to civil or administrative sanctions. What is being prevented by the regulations, therefore, is the potential for data protection rights to be used as a way of undermining these and other essential functions. This could be done by way of a data access request or multiple requests seeking the disclosure and possibly amendment or deletion of information that is part of an active investigation or inquiry that therefore fundamentally undermines the processes under way.

Turning to the content of the draft regulations, each is composed on the same lines of policy and technical approach. They were prepared with the Office of the Parliamentary Counsel and in close consultation with the three bodies. The regulations respect the right to data protection including the interests of the data subject. The data subject's rights are only restricted insofar as is necessary and proportionate to protect the functions of the statutory agencies. First, any restrictions must be considered on a case-by-case basis following an assessment of the relevant circumstances. Second, safeguards are in place obliging the CCPC, the CEA, and IAASA to notify the data subject and provide reasons for the restriction, unless to do so may prejudice the achievement of a relevant objective. Third, the data subject must be informed of the right or obligation affected by the restriction, whether the restriction applies in whole or in part, and of the right to lodge a complaint with the Data Protection Commission. The proposed measures also require the bodies to have in place certain policies and procedures relating to safeguards to prevent abuse or unlawful access or transfer of data and purposes of the processing or categories of processing. The measures also require that each body ensures that all information provided in relation to these regulations is provided in a clear, concise and accessible manner.

In accordance with the provisions of the Data Protection Act, my Department consulted with the Data Protection Commission and the Minister for Justice on the draft regulations. Following that consultative process, the Data Protection Commissioner wrote to confirm that the commission has identified no matter which is of significant concern in relation to the proposed regulations. The Minister for Justice has also acknowledged her agreement with the proposed measures.

The legal instruments are balanced and proportionate and there are strong policy reasons for adopting the restrictions sought. There is a reasonable expectation that the absence of restrictions to access to personal data will pose a serious risk to the statutory functions of these high-profile bodies. It is in the public interest that they are able to function effectively and efficiently. For the purposes of their civil and administrative enforcement functions, it appropriate that they be permitted to avail of the section 60 restrictions.

I recommend to the committee that the statutory instruments are necessary and balanced. I thank the Chairman and members of the committee for their time today.