James Browne (Wexford, Fianna Fail) | Oireachtas source

The Attorney General has of course approved this legislation, as is always the case.

The Zalewski case related to procedures of the Workplace Relations Commission, WRC, which is a body established under the operating practices pursuant to the Irish law. Unlike the WRC, the DPC is an independent supervisory authority within the meaning of chapter 6 of the GDPR and is responsible for the monitoring the application of EU data protection law "in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union". As such, it is mandated under the GDPR and the Data Protection Act 2008 to carry out the task and exercise the powers of the national supervisory authorities and contribute to the consistent application of the regulation throughout the European Union.

Regarding the specific elements of the amendment, section 26A(1) provides that the Data Protection Commission may issue a writing notice to a person known as "a relevant person" where it is or will be providing that person with confidential information directing the person not to disclose the information unless required by law or authorised by the commission. The notice must identify the information that is confidential and the specific reason why with reference to the definition of confidential information in subsection(5), if it is confidential. Where a person fails to comply with a direction not to disclose, he or she commits an offence and is liable on summary conviction to a class A fine. This is an extension of the existing offence provisions which currently apply under section 26(3) to the new section 26A.

"Confidential information" is a defined term in the proposed section 26A(5) and means "commercially sensitive information" within the meaning of section 149(7) of the 2018 Act, information given in confidence and on the understanding that it will be treated as confidential and where the disclosure of such information would be likely to prejudice the giving to the commission of further information and it is important the commission continues to receive such information for the purpose of the performance of a relevant function or information the disclosure of which could, in the opinion of the commission, reasonably be expected to prejudice the effectiveness of the performance of a relevant function. The amendment, and therefore the ability of the commission to prohibit disclosure of confidential information only applies in the context or relevant functions, which are defined in the proposed section 26A(5)(a) as being:

(i) carrying out an investigation within the meaning of section 105,

(ii) handling a complaint within the meaning of section 107,

(iii) conducting an inquiry within the meaning of section 107,

(iv) handling a complaint within the meaning of section 118,

(v) conducting an inquiry within the meaning of section 118,

(vi) carrying out an audit under section 136(1), or

(vii) carrying out a data protection audit within the meaning of section 136(4), or ... [functions] of an authorised officer under section 137(5) or 139(1).

There are also limits provided for in relation to the duration for which the obligation not to disclose lasts, while the proposed section 26A(4) provides that where information is confidential because its disclosure could prejudice the effectiveness of the performance of a relevant function, that ceases once the relevant function has been performed.

In conclusion, the provision is not about the Data Protection Commission telling the data subjects and their representatives, or both, what they can or cannot do with information they have obtained independently regarding alleged breaches of data protection rules. It is about the treatment of information provided to a person by the DPC. This is absolutely about protecting data; it is about protecting the data the DPC acquires in the performance of its unique role of investigation and inquiry. That is the information that is being protected here and not some of the other arguments that have been put up.

See this speech in context