Mick Wallace (Wexford, Independent) | Oireachtas source

I move amendment No. 6:

In page 15, between lines 23 and 24, to insert the following:“(3) A mechanism shall be provided to allow a person to whom a service is being or is to be delivered by a public body to instruct that public body that they do not regard collection of their personal data by any public body directly or on a case by case basis as burdensome and in such an instance (2)(ii)(III) shall not apply.”.

On Committee Stage the Minister of State, in commenting on these amendments, said: "Imagine a situation where a driver would not give his or her consent to have penalty points information shared between one arm of the State and another." He also stated a person who was not tax compliant would be empowered by our amendments not to give consent to the sharing of his or her data between the agencies of the State. Both comments reveal a fundamental misunderstanding of basic data protection law. The Minister of State presumed that consent was always required, but that is not the case. Article 6 of the general data protection regulation, GDPR, lists various exceptions to the consent requirement. One such exception is processing necessary for the performance of a task carried out in the public interest or the exercise of official authority vested in the controller. Processing taxation data clearly has a legal public interest basis. Section 60 of the Data Protection Act deals with public interest processing and sets out clearly that it permits data processing without consent of the data subject for "the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties" and "the administration of any tax, duty or other money due or owing to the State or a local authority". Raising the issue of consent in the case of penalty points is misleading in the context of a massive data sharing project such as this. I do not think the Government should go down that road. The Data Protection Act transposes the law enforcement directive which applies instead of the GDPR in the processing of personal data carried out for a law enforcement purpose. It is clearly not possible for a person to withhold his or her consent to data sharing in order to avoid arrest or prosecution and suggesting otherwise is nonsense.

Amendments Nos. 6 and 9 aim to address the issue of processing for reasons other than that for which data are collected. Public services card registration is only one of the points of data collection addressed by the Bill. It clearly applies to many other instances of data collection not addressed by amendment No. 5. Amendment No. 4 in the name of the Minister sought to delete lines 23 to 25 on page 10 of the Bill, while amendment No. 10 in his name seeks to delete lines 25 to 27 on page 33. The Bill seeks to empower State entities to access a citizen's personal data given for one specified purpose for another. That contravenes the GDPR and the Bara judgment. Our amendments would create an opt-out. They would not require a person to be asked whether he or she consented. I appreciate that the amendments would create difficulties for the Department. However, as it is not administratively ready to implement the Bill in compliance with the GDPR and EU case law, the Minister of State should not try to bring the Bill through the House until it is so ready. Amendments Nos. 6 and 9 would build on and make meaningful the amendments proposed by the Minister of State and passed in the Seanad in ensuring disclosure of data was not possible simply to avoid a financial burden on a public body but rather was permitted to avoid a financial burden on a person or data subject.

Under the GDPR, when consent is required, it must be informed and specific. Recital 32 of the GDPR provides that data must be collected for a single specified explicit and lawful purpose. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them.

The data sharing agreements proposed in the Bill are to be welcomed, particularly the personal access portal. However, if the type of processing envisaged under the data sharing agreements requires consent and if the processing or sharing is different in purpose from the initial purpose for which the data were collected, the data sharing agreements will not address the necessity for informed specific consent. Amendments Nos. 6 and 9 would remedy the issue.

That is a problem. If one has consent for a specific process and wants to process data for a new purpose, it needs to be asked for again as the initial explicitly given consent no longer applies. It is good that public services are efficient and that State agencies and public bodies reduce cost. We fully support this idea, of course, but it is a separate argument. The State cannot act illegally and our amendments are trying to make sure it does not. It is up to the Minister of State and his Department to come up with the administrative solutions to deal with them.

See this speech in context