Charles Flanagan (Laois, Fine Gael) | Oireachtas source

The short answer to Senator Higgins is that I will not accept her amendment, minor and all as she suggests it is. Actually, she used the word "small", which is somewhat different. I would be pleased to give it further consideration and see how we can meet each other on Report Stage, but I will not accept it as currently drafted.

Amendment No. 15 proposes the deletion of section 34(1). I will give vent to a number of reasons as to why I will not accept it. Article 6.3 of the GDPR provides that the basis for the processing referred to in Article 6.1(c) and (e) shall be laid down in EU law or national law and that the purposes of the processing shall be laid down in that legal basis. Unlike the position in some member states, however, Acts of the Oireachtas that confer statutory functions on public authorities and bodies do not normally provide specifically for the processing of personal data for the purpose of discharging statutory functions. The same applies to functions deriving from our Constitution. The processing of personal data for those purposes is implicit rather than explicit.

This is an issue of legal certainty, and to ensure that, section 34(1)(a) provides that the processing of personal data shall be lawful to the extent that such processing is necessary for the performance of a function conferred by an enactment or the Constitution. This is fully in line with Article 6.1(c) of the GDPR which provides that data processing is lawful if it is necessary for compliance with a legal obligation to which the controller is subject. What is important here is that, first, a statutory function must have been conferred on the controller by law and, second, the processing shall be lawful to the extent that the processing is necessary for the performance of that function.

Section 34(1)(b), which the amendment also seeks to delete, provides a statutory basis for data processing that necessarily arises where non-statutory schemes, programmes, funds or arrangements are administered by public authorities, such as a Department, in the performance of a function conferred on them by an enactment or the Constitution. Let me give an example. In terms of social welfare, some important and valuable schemes are administered by the Department of Employment Affairs and Social Protection but operate on a non-statutory basis. I am referring to, for example, the free fuel scheme, the free travel scheme, the back to school clothing and footwear allowance and the school meals programme. Such non-statutory schemes have also been put in place in the past to deal urgently with emergency situations such as our current adverse weather conditions, the aftermath of a storm, flooding, landslides, farm crop destruction and fodder shortages, of which Senator Coffey and others will be aware. Passing specific legislation to deal with such cases is not something that we do because we do not deem it necessary.There is also the question of timing and of the need for the Oireachtas to respond urgently to supply aid or assistance to communities. All these schemes will require the processing of personal data of applicants and beneficiaries. This is widely permitted under the terms of the general data protection regulation, GDPR. Recital (41) states: "Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament." I invite Members to agree with me that there are circumstances where these non-statutory schemes, or other similar non-statutory measures, are important and beneficial to communities. We should not put them at risk by creating conditions of legal uncertainty following the coming into force of GDPR later in the year. In these circumstances I suggest that amendment No. 15 be withdrawn because of the uncertainty that will ensue.

I am concerned that acceptance of amendment No. 15a may also jeopardise operation of certain statutory and non-statutory schemes and measures. I wish to impress on Senators the fact of Article 61C GDPR being based on a necessity test. It does not incorporate a proportionality test but inserting a reference to proportionality here could well have an adverse impact on some of the schemes whose administration we from time to time facilitate. It could leave them open to challenge and to an interpretation of uncertainty. I will give further consideration to amendment No. 15a but I will not accept it today. I do have a difficulty with amendment No. 15 and ask Senator Ó Donnghaile to reflect on my point. If he were to withdraw it he could reserve the right to come back on Report Stage.