Seanad debates

Thursday, 22 March 2018

Data Protection Bill 2018: Report Stage

 

10:30 am

Photo of Alice-Mary HigginsAlice-Mary Higgins (Independent) | Oireachtas source

These amendments relate to section 33 of the Bill. We discussed it at length on Committee Stage. It concerns the "Suitable and specific measures for processing". These measures are a toolkit introduced by the Minister as suitable specific additional measures for processing. They are usually applied in a situation where the consent of the data subject, the person, is being bypassed. They relate to many sections of the Bill whereby a legislative permission to process data is put in that does away with the requirement for consent.

The Minister has engaged with me in this area. I feel, however, that there may be a distance to travel. I knew this would be resubmitted so I have only touched on these areas. I will not go into great detail. Could the Minister explain why he has removed what was part (vi), "other technical and organisational measures designed to ensure that the processing is carried out in accordance with the Data Protection Regulation and processes for testing and evaluating the effectiveness of such measures." That was in the previous version of the Bill and I thought it was positive. While "pseudonymisation" and "encryption" are kept, the tool, or option, to use other technical and organisational measures seems to have been removed.

Previously, the Minister would have regard to the public interest and the need for the protection of individuals in respect of the processing of their personal data. I may be incorrect but it seems to have disappeared from the section or it has been moved. There will be reference again and again to suitable and specific measures. Even in our last discussion the Minister invoked the capacity to introduce suitable and specific measures as an assurance to us. It is important, however, that while this amended section 33 states that the Minister can consult with other Ministers and the data commission, there is no guarantee that a Minister will take the advice of the data commission and we do not have a mechanism for transparency such that in those cases where a Minister chooses not to take the advice of the data commission we at least are informed of the rationale for that.

When we are being told about this toolkit it is important to remember that Ministers may or may not choose to use the toolkit fully. While I recognise and appreciate that when the Minister gives suitable and specific regulations they may be mandatory for the data controller, the target of the regulation, there is still nothing mandatory about the Minister's action or indeed anything fully transparent and accountable about the Minister's decision on how the regulations are formed. I acknowledge that the impact of the regulations is strengthened in some ways by the amendments here but the making of them leaves something to be desired. Perhaps we can pursue that further.

Comments

No comments

Log in or join to post a public comment.