Alice-Mary Higgins (Independent) | Oireachtas source

I move amendment No. 60:

In page 84, lines 27 to 30, to delete all words from and including “shall” in line 27 down to and including line 30 and substitute the following:

"shall investigate the complaint, having regard to the nature and circumstances of the complaint, unless the Commission considers the complaint to be frivolous or vexatious.”.

This an overriding concern which cuts across the Bill. As a whole, the Bill provides a number of exemptions for public authorities and, as I mentioned at the very beginning of our discussions, it is not robust enough in ensuring effective mechanisms for the realisation of rights with data. We have a situation in the Bill where for the individual who wishes to call on, or invoke, his or her rights to data protection, that individual's rights to insist on data protection are voidable in many circumstances in relation to public authorities and very difficult to enforce in relation to private companies. To a large extent, the only course of action for an individual who wishes to pursue his or her rights and justice in terms of data protection in respect of the data controller is to go to the data commission. However, the data commission is empowered to not take on an individual's concern. Any individual can pursue a case to the European Court of Justice but that is a very high bar. It is not something available to most people.

In many cases, people will want to seek justice or redress at the earliest point. They may not be interested, for example, in pursuing cases through the courts for compensation. In many cases, individuals may simply want an appropriate action to be taken, perhaps, for example, to have their data removed if it has been inappropriately held or their data not to continue to be shared, if they believe it has been inappropriately shared.

For people who find their data rights contravened, or for people who believe they have been contravened, after going to the local data controller, the main course of redress they have is to go to the Data Protection Commission. However, in this section, the Data Protection Commission is given the right to refuse to investigate a complaint. I am aware that under this Bill the Data Protection Commission will a huge volume of work placed on it. That is clear in all the sections of the Bill. However, I am concerned that the commission may choose to deny an individual an investigation of his or her complaint.

My amendment reads that the commission shall investigate the complaint, having regard to the nature and circumstances of the complaint, unless the commission considers the complaint to be frivolous or vexatious. This is to introduce a higher bar for any case where the data commission may choose not to investigate a case. We all know there may be cases which would be frivolous or vexatious. However, those should be the bars rather than a danger that it may be refused.

The other point is that section 104 states that the commission shall examine the complaint and shall, in accordance with this section, take such action in respect of it as the commission, having regard to the nature and circumstances of the complaint, considers appropriate. Amendment No. 61 seeks to insert the following words: "with the consent of the parties concerned" after the word "Commission". That is in respect of consent around further action. I understand there may be situations whereby a criminal justice issue arises, so I am not going to press that amendment because I realise it is imperfectly worded. However, the spirit of that amendment is to try to say there should still be a level of consent of the parties involved.I previously spoke about the amendment of the Bill on page 85, line 6, saying the rejection of the complaint would only arise where the commission considered it to be frivolous or vexatious. Amendment No. 63 reads: "In page 85, line 7, to delete “dismissal of the complaint” and substitute “dismiss the complaint if the Commission is of the opinion that an infringement of a relevant enactment has not taken place". It is not clear if dismissal will be a matter of judicial interpretation. Will it be dismissal on a specific basis or simply a dismissal?

Amendment No. 66 reads: “(iii) rectify or erase personal data or restrict processing pursuant to Article 16, 17 or 18, and, in respect of that action, to comply with Article 19 and, where applicable, Article 17(2)”.

The last point is probably one of the more important as we know it can cause distress. It refers to where an action has been taken. When the commission has made a decision, it should give the complainant a notice in writing informing him or her of the action taken and also the rationale for said action. For example, if it believes the complaint has no basis, that there has been no transgression or that it is vexatious, the reason the action is being dismissed should be given. It is part of a wider concern I have.

I will not press any further amendment since I know that we are coming close to the end, but how does the Minister see individuals being able to effectively take action when their data rights have been breached? They will, of course, complain to the data controller, but will it be done through the data protection commission? If the commission refuses, what recourse will there be? On Report Stage I may seek to bring forward certain mechanisms to, where there is a large volume of individual complaints, trigger an automatic investigation. There may be a large number of individuals who feel powerless to complain on a subject. Perhaps where a large volume of individual complaints have built up, it might trigger an automatic mechanism.