Jim O'Callaghan (Dublin Bay South, Fianna Fail) | Oireachtas source

It is important that, if there is a data breach, a person affected have an entitlement to seek a judicial remedy. This is provided for in section 116. However, amendment No. 100 tabled by Deputies Clare Daly and Wallace is not only novel but would also completely alter the way litigation was conducted. Currently, if someone is the victim of a data breach, he or she goes through the process with the commission. If that person wishes to bring a case to court, it is wrong to say he or she cannot do so. Most solicitors will take actions on a no foal, no fee basis. These actions will get to court. However, what makes amendment No. 100 so novel, which is an understatement, is that it would enable a not-for-profit body to take an application to court on behalf of a person whose data had been breached, even if that person had not mandated the action. It would be an extraordinary change to the way litigation is conducted. Someone who did not want to go to court or did not say he or she wanted to do so would have a case taken for him or her, independently of his or her mandate, to the courts.

Speaking as a lawyer, this would probably be one of the most popular legislative measures ever introduced. There might be statues built to Deputies Clare Daly and Wallace outside Blackhall Place in the years to come if the amendment was to get through. However, it would be an inappropriate amendment. For example, industrious and enterprising lawyers could decide to set up a not-for-profit organisation. It would be established legitimately and have legitimate interests and take actions on behalf of persons whose data had been breached. They would not mandate the actions or ask the not-for-profit body to go to court. The body would go to court; the case would be lengthy and complex and, while there might not be an award of damages, an injunction or declaration could be granted. The successful party would then be entitled to apply for and receive costs. Were I an industrious and entrepreneurial lawyer, I would set up a not-for-profit body that would take such cases, at the end of which I would receive a large amount in costs. That is not the reason Deputies Clare Daly and Wallace tabled the amendment and Article 80(2) of the regulation expressly provides for this, but it would be inappropriate for our system. Many people have gone before the courts as a result of data breaches. They received a good service and their cases were taken on a no foal, no fee basis. If someone wants a judicial remedy, he or she needs to be interested in going before the court. It would be inappropriate for someone's cause of action to be brought before the court by a body that did not have his or her mandate.

On the other amendments in the group, amendment No. 114 reads, "independently of the data subject's mandate". For the reasons I have outlined, that would not be appropriate. Amendments Nos. 115 to 117, inclusive, are in the same vogue, but I agree that it would be wrong to set aside the decision made by the committee when we agreed to insert in the section an entitlement to award compensation. If someone takes a case to court, the way we reflect damages in the legal system is by an award of general damages. It is a pyrrhic victory if someone who finds out that his or her data have been breached goes to court and succeeds only to receive no award of damages. Unless I hear something persuasive from the Minister, I will not support amendment No. 122.

See this speech in context