Alice-Mary Higgins (Independent) | Oireachtas source

I move amendment No. 27:

In page 34, to delete lines 1 to 7 and substitute the following:"(b) the effect of that decision is to grant a request of the data subject."

The GDPR is clear that persons should not be subjected to automated decision-making, and decisions that will have a significant impact on the lives of an individual or a data subject should not be made automatically. This relates again to Article 22.1, which states, "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her ". However, the Government exempts itself from that under the section, which states that those protections will not apply where "the decision is authorised or required by or under an enactment" and either "the effect of that decision is to grant a request of the data subject" or "in all other cases ... adequate steps have been taken by the controller to safeguard the legitimate interests of the data subject...". The concern is that the Government is giving itself permission to have an automated decision made in respect of an individual, which directly contravenes the spirit of Article 22. I recognise that there may be circumstances in which it might be expeditious when a large volume of requests are being put through that they are processed in a positive way. However, I am concerned that section 51(b)(i) provides that an automated decision could be made which would deny a request made by the data subject. Somebody may, for example, be subjected to an automatic refusal in respect of a social protection payment, with the decision not made with due consideration by an official but by an algorithm. It would be deeply contrary to the spirit of the GDPR, which specifically seeks to safeguard against the impact of automated decision-making.

I acknowledge section 51(b)(ii) states, "in all other cases (where subparagraph (i) is not applicable), adequate steps have been taken by the controller to safeguard the legitimate interests of the data subject which steps shall include the making of arrangements to enable him or her to make representations to the controller in relation to the decision.". This means that the data subject can be automatically refused on the basis of his or her data being processed automatically by an algorithm or other programme but he or she can then make an appeal. In many cases, the gap between the refusal and the taking of the appeal could have negative consequences for an individual. This does not exclusively relate to social protection schemes but the Minister will excuse my mind going there because this concern has been raised in other jurisdictions and I am a member of the Joint Committee on Employment Affairs and Social Protection. If persons were automatically refused disability or child benefit or, for example, refused a driver's licence, the impact would be significant and immediate. Simply knowing that they can make representations and have a period to appeal is not adequate.

The amendment provides that there can be an automatic decision where that decision grants a request when, for example, 1,000 people have been asked to apply and it would not have a detrimental effect but automatic decision-making should not have a detrimental effect on people. We should be true to the spirit of Article 22.