Alex White (Dublin South, Labour) | Oireachtas source

Section 66C(2) clarifies section 6A of the Data Protection Acts 1988 to 2003, which is the main legislation dealing with data protection. This legislation relates to the processing of personal data which is likely to cause damage or distress. This is a fundamental principle in the Acts. Section 2 provides that this provision in the Data Protection Acts does not apply where the processing is necessary to undertake a legitimate postcode activity. This would cover, for example, a circumstance in which an owner or occupier of a property disagrees with the matching of his or her address to an Eircode, in particular, the routing key element of the Eircode, despite the accuracy of such matching. Section 66C(2) is, therefore, an essential provision in the Bill.

I remind Senators that section 7 of the Data Protection Act already provides that data controllers and processors owe a duty of care to data subjects. This duty relates to the collection of and dealings with personal data. The provisions of the Data Protection Acts apply in respect of breaches of the rights contained in the Acts. Section 30 of the Data Protection Act 2003 provides that the Data Protection Commissioner may bring summary proceedings for an offence under the Act. Section 31 of the Act provides for penalties for offences under the Act.

It is neither appropriate nor necessary to provide for offences of breaches of data protection rights when such provisions already exist in the Data Protection Acts. In addition, the Bill provides that the Minister can make regulations providing for a power to suspend or terminate a value-added reseller licence, as well as the power to carry out audits. The activities covered by this Bill are only those which are essential to the delivery and maintenance of the postcode system. The Senator is motivated by a concern to ensure that personal data continue to be protected and I share his view that it must be protected. I remind him, however, that users will still be subject to the full rigours of the data protection legislation.

To put this in another way, we are making an exception but one which only covers dealings with the postcode. If there is any linkage of the postcode to a name or some other identifier, all the existing protections under the Data Protection Act will apply. The best way to describe what is being proposed is that while we are making an exception, it will only apply to the use of the code simpliciter. Once the code becomes identifiable with an individual or any other information that would link it to an individual, all the existing protections in the Data Protection Acts will be triggered. It is extremely important to clarify the matter and confirm the position.

On the extra-territorial effect of the legislation, the Data Protection Act applies to all data controllers established in the State. Section 11 of the Data Protection Act provides for restrictions on transfers of personal data outside the State. The transfer of personal data by a data controller to a country or territory outside the European Economic Area may not take place unless that country or territory provides an adequate level of data protection. I emphasise that this is existing law.

Furthermore, under section 11 of the Data Protection Act, the Data Protection Commissioner may prohibit the transfer of personal data from the State to a place outside the State and may serve a prohibition notice on the data controller or data processor. These provisions will continue to apply. Moreover, the Bill provides that the Minister may make regulations requiring a value-added reseller to provide evidence of having registered with the relevant data protection authority, where applicable, before a value-added reseller licence will be granted. This requirement is not limited to registration with the Irish Data Protection Commissioner.

For these reasons, it is not my intention to accept the proposed amendments.What is concerning the Senator is that there is an exception being made here but that exception is very narrow. It only deals with the treatment of the actual code. I will not say a code on its own is meaningless because it is the postcode for the house but once there is anything that links it to the Senator, me or any other citizen, the existing protections kick in.