Charles Flanagan (Laois, Fine Gael) | Oireachtas source

Chapters 2 and 3 of Part 6 contain key sections dealing with enforcement of the GDPR and the directive, respectively. Sections 108 and 121 are key sections dealing with the handling of complaints by the commission. As I said earlier and on Committee Stage I fear there may be some misunderstandings about how they will operate. So, at the outset, I will briefly run through the complaints system as set out in the Bill.

Section 108(1) requires the DPC to examine every complaint it receives and to take such action as it considers appropriate, having regard to the nature and circumstances of the complaint. Where, as referred to in subsection (2) of that section, an amicable resolution is not reached in those cases in which the commission considers that there is a reasonable likelihood of the parties reaching such a resolution within a reasonable period, the commission must proceed to take an action specified in subsection (5) in a domestic case, or under section 112 in a cross-border case.

Section 108(4) makes it clear that the commission is under an obligation and that it "shall proceed" to take action. It does not have discretion to simply ignore or disregard a complaint. This means that the reference to "such action" in subsection (1) is a reference to action that the commission must take, not to whether or not to take action.

As regards notification of the data subject, subsection (6) requires the commission, as soon as practicable after taking an action referred to in subsection (5), to give the data subject a notice in writing setting out the action it has taken in response to his or her complaint. As regards paragraph (e) of subsection (5), where the commission conducts an inquiry under that provision in respect of the complaint, it may use any of its extensive powers under Chapter 4.

Under section 111, where an inquiry has been carried out in respect of a complaint and the commission is the competent authority, at that stage the commission must decide whether an infringement has occurred or is occurring. Where it concludes that an infringement has occurred or is occurring, section 111(2) obliges the commission to make a decision on whether a corrective power should be exercised and, if so, the power that is to be exercised.

The corrective powers are set out in Article 58(2) of the GDPR, and they include the possible imposition of hefty administrative fines. Following the making of a decision under section 111, section 115(1)(a) requires the commission to notify the controller or processor concerned in writing of the decision; the reasons for it, and the corrective power it has decided to exercise.

Section 115(1)(b) requires it to provide the same information to the data subject who lodged the complaint. A broadly similar procedure in section 121 applies to the handling of complaints under the directive. That is a summary of the complaints procedure.

I will not respond to each amendment in this large grouping, but I will focus on the key amendments. As regards Deputy Ó Laoghaire'samendment No. 101,which would replace section 108(1), I have a serious problem with the introduction of a discretion on the part of the commission not to investigate a complaint that may be "frivolous or vexatious." First, it would not be GDPR-compliant. Article 57.4 allows a data protection authority to refuse to act on a complaint only where requests "are manifestly unfounded or excessive." Any wider refusal to act on a complaint will in my view be in breach of the GDPR.

Second, as I said on a previous occasion, while the term "frivolous or vexatious" has a specific meaning here when used by Irish courts, that is, that the claim is unsustainable in law and is bound to fail or has no basis, I would not think it is widely understood across Europe. It is a term that is understood by us here in our law under our common law system and system of litigation. It may perhaps be understood in the UK but its future in Europe is under question. However, that is a debate for another day. This is a term that is not widely used nor indeed is it widely understood. On the contrary, to a data subject or a data protection authority in another member state, use of the word "frivolous" suggests that the matter is not regarded as sufficiently serious for investigation, while "vexatious" has a completely different meaning, namely, that the complaint is seen as a deliberate intention to cause annoyance. The scope for such misunderstandings will be much greater under the one-stop-shop mechanism because the data protection commission will be acting as the lead supervisory authority in many cross-border cases.

Unfortunately, the term "frivolous and vexatious" is used in section 10(1)(b) of the 1988 Act and it has created confusion and misunderstandings in recent years, especially in cross-border cases. Deputy Daly mentioned the Schrems case. In that case Judge Hogan commented that the wording of that provision "is somewhat unfortunate". He went further than that and said it might indeed be "unhelpful". Its use was widely misinterpreted and misunderstood in the aftermath of that case in which Mr. Schrems successfully contested the adequacy of the safe harbour mechanism. The risk of misinterpretation and misunderstanding will be very much greater because of the expected increase in the number of one-stop-shop cases handled by the DPC, which have originated in other member states. I will not accept the alternative models put forward in the amendments to the complaints-handling mechanisms in Chapters 2 and 3 of Part 6.

As regards amendments Nos. 102 to 105, inclusive, I cannot accept the proposals therein to delete the options set out in section 108(5). The same applies to amendments Nos. 118 to 120, inclusive, which would involve similar deletions in section 121.

Consequently, amendments Nos. 106 and 121, which propose to insert new sections in Chapters 2 and 3 are not acceptable. Amendments Nos. 107 to 113, inclusive, and 125 to 128, inclusive, are consequential or related and because I cannot accept the earlier ones I will not accept those. In her concluding remarks Deputy Daly suggested that I might ask the commission for guidance and I will do that. I am happy to take the matter further in that regard.

My amendment No. 124 merely amends an incorrect cross-reference in subsection (1) of section 132. Thank you for your forbearance, Acting Chairman.

See this speech in context