Alice-Mary Higgins (Independent) | Oireachtas source

I have very serious concerns about this area. I raised them when the Bill was passed by the Seanad and they have deepened somewhat. While I recognise that there are some constructive elements to the amendments which have been made and it is important that people are able to do their representative work as described by Senator Conway, I am concerned that the serious dangers I flagged very clearly during the course of the debate in the Seanad were not addressed at all. In fact, the danger may have increased.

There have been ongoing revelations in recent months around the role of political consultancy and data mining firms such as Cambridge Analytica in election campaigns. We know there are hundreds, if not thousands, of clones of similar public and political consultancy and data mining firms. My concern about the previous incarnation of the Bill was that it did not have enough to ensure that the exemptions which were being made in respect of electoral activities by specified persons, such as political parties, Members of the Houses or the European Parliament, candidates for office for election to any House and so forth, would preclude such actors from signing a contract with or hiring the services of a private company such as Cambridge Analytica, or its many imitators, and effectively using the exemption granted in the Bill. We need to bear in mind that a single candidate could decide to become a candidate simply for this purpose. I am concerned that we may have given a very wide exemption to such an actor and, through him or her, to private actors or companies which may wish to influence electoral outcomes in our country.

I highlighted that Article 9, which deals with what is recognised by the GDPR as a special category of personal information, that is, political opinion, is recognised as a sensitive category of personal information and one which needs particular protection. I highlighted that I was concerned that what had been brought forward in the Bill had exceeded the generous provision which was made under Article 9(2)(d), that is, the processing of a special category of personal information like political opinion. It states that it is legitimate to process political opinion when that is carried out in the course of legitimate activities, with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim. Crucially, this is on the condition that the processing relates solely to the members or former members of that body or persons who have regular contact with it in connection with those purposes, that is, for example, party members or constituents, and that the personal data are not disclosed outside that body without the consent of the data subject.

Under Article 9(2)(d), a person can function as a political party or representative and communicate in respect of the political opinion of constituents or members. A person cannot, however, share the information of constituents or those in touch with him or her or party members with a private company or another external actor without getting consent. That might mean a person can work with a focus group, RED C and so on, but if he or she does so, that person needs the consent of data subjects. I raised the concern that the Bill as posited did not contain the same limits and an attempt has been made to get around that.

An amendment invokes the public interest. Instead of relying on Article 9(2)(d), the part which refers to the question of public interest seems to have been invoked in a very sweeping way. This is the section to which I will speak longest. I will be much shorter about other sections.