Patrick O'Donovan (Limerick County, Fine Gael) | Oireachtas source

I move amendment No. 8:

In page 20, to delete lines 34 and 35.

This has the effect of removing section 21(6). Section 21 requires one of the parties to a data sharing agreement to be designated as the lead agency responsible for carrying out the functions specified in the section and elsewhere in the Bill relating to data sharing agreements. It sets out a number of functions that the lead agency would have and some of these functions relate to the control of data under the GDPR. Section 21(4) provides that a person can direct a request to exercise their data subject rights to the lead agency.

Section 21(6) of this section was included on foot of an amendment proposed in the Seanad, providing that "This section is without prejudice to and does not limit the rights of a person as a data subject in respect of any or all data controllers in a data sharing agreement.". I accepted the amendment in the Seanad because my officials and I believed it simply reinforced the position that under the GDPR a person has a right to direct requests to exercise data subject rights to any data controllers in a data sharing agreement. Subsequently, the Attorney General's office raised concerns regarding the subsection. The concern is that the wording "This section is without prejudice to" introduces legal uncertainty in whether data subjects would have full access rights under the GDPR in respect of any data sharing agreement arrangements made under the legislation. It implies there is prejudice in other sections of the Bill and it is on that basis we have sought to amend it.

The Attorney General's office has advised that this provision should be deleted because the inclusion of this subsection brings about unnecessary doubt as regards the hierarchy between rights under the GDPR not referred to in section 21(6), on the one hand, and section 6, on the other; as well as rights under the GDPR referred to in section 21(6) on the one hand and other sections of the Bill on the other. I withdrew the amendment on Committee Stage in order to provide an opportunity to explain the advice I have received from the Office of the Attorney General to the House. I thank the Members who met me and officials from my Department for their constructive engagement. The policy intent is that no rights under the GDPR and the Data Protection Act 2018 are to be affected by this Bill. This is already achieved by section 6, which provides that nothing in this Act shall affect the operation of data protection law and by the doctrine of supremacy of European law. Accordingly, I ask that the provision be deleted rather than cause any unnecessary uncertainty for citizens. I ask the House for its support.

See this speech in context