James Browne (Wexford, Fianna Fail) | Oireachtas source

I thank the Deputy for raising this important matter. The Courts and Civil Law (Miscellaneous Provisions) Bill 2022, which was signed by the President on 5 July 2023, makes a number of amendments to the Data Protection Act 2018. As the Deputy will be aware, section 67 inserts a new section 26A into the Data Protection Act to provide a prohibition on disclosure of confidential information by persons engaged with the Data Protection Commission, DPC, in connection with certain defined functions. The purpose of this amendment is to bolster the integrity of the statutory processes and the provision to the DPC of confidential and commercially sensitive information in the course of carrying out certain statutory functions. Under the GDPR, the State has a duty to ensure that the DPC is provided with the powers necessary for the effective performance of its tasks.

Section 26A(1) provides that the DPC may issue a written notice to a person, known as a "relevant person", where the commission is or will be providing that person with confidential information, directing that the person not to disclose that information unless required by law or authorised by the commission. The prohibition on disclosure does not, however, apply where disclosure of the confidential information is required or permitted by law or authorised by the commission in writing. The notice must identify the information that is confidential and the specific reason it is confidential, with reference to the definition of "confidential information" in subsection (5).

The amendment, and therefore the ability for the commission to prohibit disclosure of confidential information, only applies in the context of relevant functions, which are statutory investigations, inquiries, audits and the handling of complaints under the Data Protection Act. There are also limits included in terms of the duration for which the obligation not to disclose information lasts. Where information is confidential because its disclosure would prejudice the effectiveness of the performance of a relevant function, that prohibition ceases once the relevant function has concluded.

Nothing in this amendment would prevent a person from speaking out about the nature of his or her data privacy complaint or that a complaint had been made to the DPC. It also has no impact on media reporting about complaints or the enforcement of the GDPR.

Additional information not given on the floor of the House

This was an amendment sought by the DPC in support of its ability to carry out its functions under the GDPR in an effective, efficient and lawful manner and to ensure fair procedures were maintained for data controllers and data subjects alike.

See this speech in context