Clare Daly (Dublin Fingal, Independent) | Oireachtas source

I move amendment No. 42:

In page 36, line 20, to delete “and special categories of personal data”.

I will try to be brief. We have resubmitted these amendments on Report Stage because they are quite important. According to recital 50, processing for purposes incompatible with the one for which the data was originally collected may be allowed if the person consents and the processing is based on European Union or member state law which constitutes a necessary and proportionate measure in a democratic society to safeguard important objectives of general public interest. Section 40 of the Bill allows for the processing of sensitive categories of data, such as one's political opinion, sexual orientation, race and so on, and general personal data for reasons other than that for which they were collected in order to prevent a threat to national security, to prevent, investigate or prosecute crimes or for the purpose of getting legal advice and so on.

Amendments Nos. 42 and 45 propose that further processing of very sensitive data would be permitted for all those crime stopping and public security reasons except the prevention of crime. The reasoning for that is that the GDPR does not apply to competent authorities such as the Garda Síochána when processing data for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. It applies to everybody except competent authorities such as the Garda.

Section 38 proposes to give public bodies or companies the right to collect or compile databases in which people's identities are linked to things such as their political opinions, trade union membership, religion and so on for the purposes of preventing crime. It is very hard to imagine a situation where information held by a private company or public body about a person's religious affiliation, sexual orientation, political opinion, trade union membership or so on would ever be so absolutely essential for preventing crime as to outweigh the dangers of the impact on people's freedom of expression and association. It would not be worth it because the prevention of crime is a very nebulous concept. The amendment would allow the passing on of special category data by private companies to the Garda for the investigation and prosecution of criminal offences or the prevention of threats to national security but the prevention of crime would be open to too many interpretations. It is a catch-all and a step too far.

Amendment No. 44 proposes that further processing of personal data would be lawful for all the various crime and security reasons but rather than it being lawful for the purposes of preventing crime, the tighter wording of "avoiding prejudicing the prevention of crime", taken from the equivalent UK legislation, would be used. Amendment No. 43 provides that further processing would be allowed only if it is necessary and proportionate for various crime and terror fighting purposes, having regard to the fundamental rights and legitimate interests of the data subject. That introduces a balancing requirement whereby such further processing would only be lawful if the fundamental rights and legitimate interests of the data subject did not outweigh the reasons to reprocess his or her personal data.

Taken as a group, these amendments do not prevent the reuse of personal data by private or public organisations in general for crime prevention but, rather, only special category data. Data such as names, phone numbers, addresses, email addresses and IP addresses could still be used for crime prevention reasons as the amendments only address data such as one's sexual orientation, trade union membership, political views and so on.

See this speech in context