Charles Flanagan (Laois, Fine Gael) | Oireachtas source

I am willing to have a fresh look at section 32 and to bring forward amendments on Report Stage if the Senator is minded not to press the amendments to section 32 on this Stage. I remind the House that the purpose of section 32, which is entitled "Suitable and specific measures for processing", is to establish a toolbox of specific and appropriate measures to be applied in the context of data processing under later sections of the Bill, namely, sections 40 to 44, inclusive, and 46, some of which have been mentioned by Senator Higgins. She is correct that we will have an opportunity to go through those section by section.All of the relevant sections make the use of suitable and specific measures mandatory. The choice of which measure from the toolbox could, should or may be used will depend on the circumstances of the processing.

I stress that these safeguards are in addition to, rather than a substitute for, the technical and organisational measures required under the risk based approach in Article 24 of the general data protection regulation. These additional measures are brought forward by virtue of the fact that they will apply to the special categories of personal data, which are referred to under Article 9 of the GDPR. In some cases, encryption of the personal data concerned might be highly desirable, while in other cases, the appointment of a data protection officer by the controller might be more effective. In this context, it is important that we consider the text of 32(4), which will permit the specification of compulsory safeguards in respect of certain types of data processing.

Having listened carefully to the Senator and examined her amendments, I accept there is a need to clarify what can best be described as the interplay between this section and the later sections which require the use of the toolbox measures. I am willing to review matters in light of the Senator's comments. Rather than dealing with the matter conclusively today, I ask her to consider withdrawing the amendment and not moving her other amendments to the section, in return for which I will give a commitment to introduce appropriate amendments to the section on Report Stage.

Amendments Nos. 11 and 18 in the Senator's name del awith consent-related issues. I understand they are part of the group because, as the Cathaoirleach stated, amendment No. 11 is an alternative to amendment No. 9b to which I have made reference. With regard to amendment No. 11, there is no need to insert the word "informed" after the word "explicit" because this is already an essential requirement for what could be described as a valid consent under the GDPR. The definition of "consent" in Article 4 makes clear that the matter of consent must always be freely given, specific and informed. Section 2(3) makes clear that a word or expression used in the Act that is also used in the GDPR has the same meaning in this legislation as it has in the GDPR unless the context otherwise requires. Amendment No. 11 cuts across this and I am not minded to accept it.

Amendment No. 18 proposes to insert a consent requirement in section 42, which seeks to give effect to Recital 56 of the general data protection regulation. I am open to considering the possibility of imposing a consent requirement. In any event, we will have an opportunity to discuss the issue again when we deal with amendments Nos. 19 to 21, inclusive.

Having listened carefully to the Senator's submissions and the reasoning behind her amendments, I give a commitment to return to the issue on Report Stage.