Clare Daly (Dublin Fingal, Independent) | Oireachtas source

In respect of amendment No. 18, on Committee Stage when the Minister listed the free fuel and travel schemes and the school meals programmes, operated by the Department of Employment Affairs and Social Protection on a non-statutory basis, he said that this processing complies with the GDPR because Recital 41 states: "Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament" each time. If this processing is compliant with the GDPR why do we need section 37(1)(b)? The GDPR already has direct application and if the Department's administration of these non-statutory schemes is already compliant we do not need anything in the Bill to make them compliant. Therefore, we are a bit suspicious about why this clause is there. Is the Minister trying to provide cover for an issue that might not necessarily be compliant, as in the instance given by Deputy Wallace where the public services card is required to obtain a passport which is non-statutory? That might be called into question because the processing is of questionable legality. Is the Minister trying to make it legal with this clause? We would be concerned about that.

Under the old Data Protection Acts there was a specific exemption for the non-statutory schemes cited by the Minister but it was much more narrowly drawn than this one. There was also an exemption in the old Data Protection Acts to allow processing of personal data for the performance of any other function of a public nature performed in the public interest by a person. This is broadly similar to what is permitted under the GDPR. We think it a bit odd that this Bill wants to diminish data protection rights relative to our law and European law rather than bring them up to the standard we are obliged to do.

Deputy Wallace dealt with amendment No. 21 about purpose limitation, one of the fundamental principles relating to processing of personal data laid out in Article 5. I do not think that for the avoidance of doubt the Minister putting in "purpose" presents a huge difficulty. It is far more specific than the word "circumstance". That is all we want to do there.

Section 22, as Deputy Wallace said, is lifted from section 48. Regulations giving statutory and non-statutory bodies carte blancheto ignore the GDPR should at the very least meet basic standards.

See this speech in context