Ivana Bacik (Independent)

I move amendment No. 6:

In page 6, between lines 42 and 43, to insert the following subsection:

"(6) Where data that relate to a person are in the possession of a service provider, and a disclosure request in respect of that data has been made under this section, that person shall be notified of the existence of the request within three months from the date of the request.".

This is proposed to ensure an extra safeguard in terms of the civil liberties aspect of the legislation. I first raised this issue in February 2009 in an article in The Irish Times. That shows just how long the legislation has been in gestation. At the time we were debating the retention periods and the mechanisms for operating the Bill. I suggested an amendment was necessary to ensure section 10(2) dealing with the complaints procedure would be effective and workable. It provides that people who believe data relating to them and in the possession of a service provider have been accessed following a disclosure request may apply to the referee for an investigation into the matter. That is an important safeguard, but how will a person know a disclosure request has been made? I suggest an amendment is required to ensure a person will be notified when a disclosure request is made under the section.

The response of the Minister of State will be that this would not be practical for security reasons and in the interests of law enforcement. There is a duty of notification in other jurisdictions, including Germany, the United States and Canada. It cannot be an immediate duty because that would endanger the system of law enforcement and hinder the investigation of a crime. However, there is no reason we could not have a duty of notification following a delay; I suggest a period of three months in this regard, but it could be longer.

In principle, this provision is important to give teeth to the complaints procedure mechanism provided for in section 10(2). The Oireachtas Library and Research Service has produced a Bills digest on the issue I have raised. The ICS has also voiced concerns about the fact that the Bill does not require a person to be notified of any leaks of data relating to them. Having a right of appeal and a complaints process is pointless, unless there is an obligation to inform a person that a disclosure request has been made.