Jim O'Callaghan (Dublin Bay South, Fianna Fail) | Oireachtas source

The three amendments under discussion all seek to provide greater protection for children under the Bill. Amendment No. 15 seeks to raise the age of digital consent from 13 to 16. I mentioned on Committee Stage that Fianna Fáil supports a digital age of consent of 16. I will not address that amendment today as my colleague, Deputy Thomas Byrne, will do so.

I wish to address amendments Nos. 13 and 14, which seek to provide greater protection for children by protecting them from micro-targeting and profiling. All Members should support that objective provided it does not conflict with the provisions of the GDPR. There is too much commercialisation that tries to target children with products such as fast food or particular games. If we can, we should provide protection from such targeting.

It is instructive to note that a child is defined in the Bill as a person under the age of 18, so amendments Nos. 13 and 14, if passed, would apply to all persons under the age of 18 rather than only those aged between 16 and 18. I would rather support amendment No. 14 as tabled by Deputy Ó Laoghaire because I note he has removed from it the term "for financial gain" which caused me concern on Committee Stage. I have a slight concern that the amendment only makes it an offence for a company or corporate body to engage in the micro-targeting or profiling of children. Companies may be able to get around that by purchasing data from individuals who carry out the profiling and targeting of the personal data. However, that is not sufficient reason for me to oppose the amendment. If I oppose it, it will be for the reason I gave on Committee Stage, when the Minister indicated that the amendment would constitute a breach of EU law because it would impose a limitation on the type of processing of personal data that is permitted under the GDPR. The Minister stated on Committee Stage that the State would be exposed to infringement proceedings and that had an impact on me.

Following Committee Stage I went back and had a look at the issues in respect of the GDPR. What we need to recognise is that we have limitations imposed upon us in the Oireachtas when we are debating the Data Protection Bill. The reason we have limitations is because the Bill itself seeks to give further effect to a regulation - the GDPR - that we know will come into effect on Friday week. No matter what we do, the GDPR is coming into effect on Friday week. It does not need to be transposed into Irish law because it will become a part of Irish law on Friday week. The Data Protection Bill also has other provisions in it which seek to give effect to other directives. The issue that causes concern is whether the amendments are consistent with the GDPR. If they are consistent with the GDPR, then I and Fianna Fáil will support them.

I went back and had a look at the GDPR and it is instructive to note that it does give very special recognition to the protection required for children. Recital 38 says that children merit specific protection with regard to their personal data. The other relevant recital is recital 47 to which the Minister referred. This indicates that the legitimate interests of a controller may provide a legal basis for processing, and therefore the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.

We then need to look at the other recital that deals specifically with profiling, and that is recital 71. It says that a data subject should have the right not to be subject to a decision which is based on profiling. An issue that arises is whether amendment No. 14 will have the effect of constituting a decision that is created by profiling. It is also instructive to note that recital 71 says that such measures which are introduced should not concern a child. The recitals are very clear. They want to provide protection for children. They also recognise that certain types of processing are legitimate. Article 4 in the GDPR makes clear that profiling is a form of processing. It is described as any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.

The Minister has relied on Article 6 on numerous occasions. Article 6.1(f) states that one lawful basis for processing is where processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Again, the GDPR gives express recognition to the vulnerability of children and the fact that they are deserving of special protection under the regulations and under any transpositive laws that are introduced in member states.

Article 22 refers to automated individual decision-making, including profiling. It says the data subject shall have the right not to be subject to a decision based solely on profiling. That will not apply, for instance, if it is authorised by the Union or member state law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests.

I and Fianna Fáil want to support amendment No. 14 but we do not want to expose Ireland to infringement proceedings down the road. I have had another look at the GDPR and it seems to be that the protection of children is very much at the forefront of the recitals in the GDPR and indeed in respect of certain articles. What the Minister has to do is satisfy my colleagues and me that if we introduce the amendment, we will not be in flagrant breach of the articles contained within the GDPR. It does not stand out that that is the case but I am interested to hear what the Minister has to say as that will very much dictate how Fianna Fáil votes in respect of the amendment.

See this speech in context