Eamon Ryan (Dublin Bay South, Green Party) | Oireachtas source

It is substantial. The amendments made in the Seanad were not insignificant. During the passage of the Bill through the Seanad, the issue of data protection related to traffic cameras and other devices was raised. Any processing of personal data is, by definition, subject to the general data protection regulation, GDPR. In addition, the Bill contains a number of further provisions which offer an extra level of data protection. These provisions include the option of making regulations on data protection in two ways. In the new section 77A, which we are inserting into the Roads Act 1993, subsection (6) allows for the making of regulations for the sharing of these data. Subsection (7) then states that regulations under subsection (6) may provide that data only be provided to persons or access to data only be given to persons on specified conditions. Following consideration of points raised in the Seanad, I agreed that "may" in this case should be changed to "shall". The effect is that if regulations are being made on the sharing of data obtained from the devices covered by section 77A, the regulations must address these data protection issues.

Similarly, we are changing "may" to "shall" in subsection (10) of section 77A. This is another subsection allowing for regulations relating to data protection. Regulations under subsection (10) would apply to anyone handling data from the devices, including local authorities and the TII, whereas those under subsection (7) relate only to data being shared with other bodies. These subsection (10) regulations relate to a range of protections such as encryption and ensuring only appropriate personnel within an organisation have access to the data. As with subsection (7), I believe it is important we ensure this kind of protection is mandatory and not optional and this will be the effect of changing "may" to "shall" in subsection (10).

See this speech in context