Alice-Mary Higgins (Independent) | Oireachtas source

I move amendment No. 29:

In page 34, to delete lines 28 to 30, and substitute the following:“12 to 22 are restricted to the extent specified in subsection (3).”.

I will speak to all the amendments together. Basically section 54 relates to the restriction of the exercise of the data subject rights. Data subject rights are the core reason we have the General Data Protection Regulation, GDPR. The function of GDPR to a large extent is to ensure appropriate protection of data sets. These are the circumstances under which it might be restricted. Again we see the situation whereby the scope of the Government to restrict a data subject's rights are very widely interpreted in the section.

Section 54 (2) states:

Subsection (1) is without prejudice to any enactment or rule of law which, on the coming into operation of this section, restricts the rights and obligations referred to in that subsection.

Section 54 (5) also gives wide-ranging powers to any Minister. We have the same concerns on the levels of ministerial discretion, which have and will be raised again and again throughout the section.

Amendment No. 30 seeks to delete section 54 (3)(a) and (3)(a) (i) to (iv), inclusive, because I believe they are very wide. The term "data subject" refers to individuals not just citizens but any individuals resident in the State, effectively the people in Ireland and their data rights.

This Bill is fundamentally about enshrining and supporting the data subject rights of people. Under section 54(3) all of their data rights may be restricted where it is viewed to be necessary to safeguard the courts, Cabinet confidentiality, to deal with prosecutions, for the administration of taxes, but also for the purposes of estimating the amount of the liability of a controller on foot of claim.

Section 54(3)(b) states: "the personal data relating to the data subject consist of an expression of opinion about the data subject by another person given in confidence or on the understanding that it would be treated as confidential to a person who has a legitimate interest in receiving the information, or." The scope of the section is wide. I understand some of the provisions, and some of them stand up, but I would like to see them teased out so that is the reason I have tabled amendments.

The crucial amendment is amendment No. 32, in which I propose to delete lines 1 to 42, and in page 37, to delete lines 1 to 12.

Section 54(7) sets out the objectives of general public interest. Earlier in the Bill, the question of public interest was discussed as a basis on which decisions may be made. Later in section 54(7) examples of public interest are set out. I have a real concern that the examples of public interest might apply here in terms of the limitation of data subject rights but they may also be used or interpreted in relation to earlier points in the Bill, where public interest was invoked. I have a number of areas of concern in regard to subsection (7), however I want to highlight section 54(7) matters of public interest include, in particular "(h) matters relating to international protection and immigration". Will individual's data rights be constrained or overridden when it relates to immigration? What are the circumstances in which this will apply? I think there is a danger of inequity of treatment, and prejudice. I have a real concern, that any person, be they a citizen, an immigrant, or an EU citizen and sharing the rights of the GDPR as well should be subject to data protection in the same way as other person. I feel there is a lack of clarity in paragraph (h) which refers to "safeguarding the economic or financial interests of the European Union or the State, including on monetary, budgetary and taxation matters" and it would be a very serious concern if immigration became in any way a basis for the restriction of a data subject rights.

That would be fine in respect of taxation matters, but what is not clear to me is what would happen in a case where an individual's exercise of his or her rights were to have a cost to the State, for example if an individual is asking to be informed of any breaches of his or her personal data. An individual's right to have the appropriate treatment of his or her data should not be removed simply because by exercising that right, the individual may have put a cost on the State.Section 54(7)(i) would allow a Department to say that, if it allowed an individual to exercise his or her rights, it may have to increase his or her payment or to offer compensation and might leave itself open to a suit in the European Court of Justice or elsewhere under the GDPR. There is a real concern that we could see access to justice and rights in the area of data protection being precluded simply because giving such access might cost money. I know the Minister will say there are other points to consider such as the necessity test but I feel this section is wide-reaching. Perhaps the Minister could fully assure me in this regard, but that is my concern in respect of section 54(7).

I will not go through each amendment in detail because I will not be pressing any of them. I just wanted to highlight two examples in what is a very long list of circumstances in which the public interest is to be interpreted very widely to the detriment of individual rights.