Charles Flanagan (Laois, Fine Gael) | Oireachtas source

I appreciate that. I did indicate already that I would revisit it, and I will. These amendments to section 54 give effect to Article 23 of the GDPR. I accept that there has been some public commentary about this section which, in many respects, has involved some misunderstanding as to the likely impact it will have. The overall purpose of this section is to offer protection to the public. These objectives are very much in the public interest. I do not see any circumstances in which it could be described as restricting the data protection rights of citizens. I would not like that interpretation to endure because the overall purpose of the section is to provide protection to the public and individuals. I will give some examples of what is intended in this section.

If we take, for example, the Medical Council or the Property Services Regulatory Authority, both embark on investigations from time to time in respect of doctors or estate agents on foot of complaints from clients or patients who allege that a serious breach or lapse has occurred or, in many cases, that a person is unfit to practice. If the data protection rights of the doctor, estate agent or auctioneer concerned are not restricted on a temporary basis while the complaint is being investigated, it would be open to that person to apply to have the data rectified, restricted or even erased completely. Of course any of these actions would have the consequence of ensuring the investigation would not be satisfactorily concluded or even take place, which would be against the interests of the person making the complaint and may well be against the public interest in the matter of the investigation of a complaint.

I would like to make it clear that regulations made under this section will permit the regulatory body concerned and other similar regulatory bodies to carry out their statutory obligations to conduct inquiries or investigate complaints in the knowledge that the individuals being investigated will not be permitted to exercise data subject rights in a manner that could derail or jeopardise such activities. Those being investigated and who are the subject matter of a complaint will not be permitted to exercise these rights to rectification or erasure while investigations are ongoing.

In a similar manner, section 54(7) will permit investigations of, for example, an alleged harassment or sexual harassment incident in the workplace and will not permit the alleged perpetrator of such an act to obstruct or frustrate the investigation that will take place by seeking to exercise rights of access, constriction, rectification or erasure of personal data. That is important. Article 23 of the GDPR allows limited restrictions on data subject rights for such purposes, and this section gives effect to that article by allowing such restrictions in order to safeguard important objectives of general public interest. It will introduce higher levels of data protection safeguards which will be superior to or will bolster restrictions already in place under section 5 of the Data Protection Act 1988, which will be well known to Senators.

I want to stress that the restrictions permitted by Article 23 of the GDPR are far more limited that those permitted under current law. In future, restrictions will be subject to the following conditions: they must be set out in a legislative measure, that is either in primary legislation or in regulations; they must respect the essence of the individual’s rights, which of course involves respect for individual freedoms; and they should be necessary and proportionate in a democratic society. These three important conditions are met in the text of section 54.

Sections 54(1) and 54(2) give effect to the introductory text of Article 23(1). Section 54(3) restricts the exercise of data subject rights and corresponding controller obligations in respect of the important objectives of general public interest outlined in sections 54(3)(a) to 54(3)(c). These include, for example, the matter of Cabinet confidentiality, the independence of the Judiciary, and the matter of parliamentary privilege, which would be well known to us here in the Houses of the Oireachtas. In the case of parliamentary privilege, the right of a data subject named during debates in this House to have his or her personal data erased from the record of proceedings is restricted in section 54(3). The manner in which data subject rights could be exercised in respect of parliamentary proceedings was raised with my Department by the Houses of the Oireachtas Commission during preparation of the Bill. This provision has been included in order to address the matters that were raised on that occasion.

I will give a brief example of an issue relating to section 54(3)(b), which carries over section 4(4A) of the 1988 Act, which is important in the context of protected disclosures and other activity that might be described as whistleblowing. This provision will protect those who wish to provide information about wrongdoing in confidence and in the knowledge that the origin of the disclosure will not be made known to the individual about whom they are providing the confidential information. Like the previous examples I have given, this section is included because it is in the public interest that the provision of such information be protected and that this new data protection regime does not in any way become an obstacle to such activity.Subsection (6) creates a regulation-making power whereby such restrictions on the exercise of data subject rights and corresponding obligations on the controller may also apply in the case of processing for other important objectives of general public interest, including those set out in subsection (7).

I want to turn now to the specific amendments. For the reasons I have outlined, I cannot accept amendments Nos. 29, 30, 32 and 34, which seek to delete important subsections, namely, subsections (3), (4), (6), (7) and (8) from the Bill. I am, however, willing to revisit amendment No. 33 on Report Stage. It currently refers to "matters relating to international protection and immigration". I take on board the concerns expressed by Senator Higgins and I accept that the wording can be improved. It is intended to deal, for example, with cases involving fraudulent applications or cases where applications for protection would be based on illegality or misrepresentation. We will come back to that. I commit to perhaps improving the wording to accord with the point raised by Senator Higgins.

Senator Ó Donnghaile stated that he will not press amendment No. 31. I am willing to revisit this issue to ensure that we do not have unintended adverse consequences.