Alice-Mary Higgins (Independent) | Oireachtas source

I move amendment No. 2:

In page 10, line 3, after “identity” to insert the following:“excepting such parts of that public service identity which constitute special categories of personal data under GDPR, including biometric data such as facial images which allow for the unique identification or authentication of a natural person”.

These amendments relate to the tension or conflict in the Bill between sections 6 and 12. Section 12 states: "This section applies to the disclosure of personal data (other than special categories of personal data) by a public body to another public body, where there is no other enactment or law of the European Union in operation under which specific provision is made permitting or requiring such data-sharing". It states it does not apply to special categories of personal data, yet section 6 has effectively been designed in a way which will permit an intersection between the public service identity dataset and section 12, with the exception of one small part of it. The problem that arises is that the public service identity dataset contains special categories of personal information. Under the GDPR, biometric data are defined as including facial images which allow for the unique identification or authentication of a natural person. There will be circumstances where biometric data such as facial images and photographs will need to be exchanged. Article 9 of the GDPR sets out the circumstances in which it may occur. Special measures need to be taken to safeguard special categories of personal data which include facial images. There is tension between section 12 in not wanting to deal with special categories of personal data and section 6 which covers how the dataset which contains special categories of personal data will be processable under section 12.

I recognise that only specified bodies, not every public body, will exchange the data, but there is tension and I have put forward a few ways by which it might be tackled. I have suggested the inclusion of the words "excepting such parts of that public service identity which constitute special categories of personal data". I have put forward another version in which I spell out the special categories of personal data to which I am referring and recognise that there may be interpretational differences. That is the reason I have put forward two versions. Amendment No. 2 which spells out biometric data include data "such as facial images which allow for the unique identification or authentication of a natural person" is better, stronger and clearer, but I recognise that the Minister, the Minister for Employment Affairs and Social Protection and others are considering and questioning whether photographs constitute biometric data. There should be no objection to amendment No. 3 which I hope the Minister of State will accept. It provides for the insertion of the following words "excepting such parts of that public service identity which constitute special categories of personal data". That would make section 6 directly compliant with section 12 which states it does not apply to special categories of personal data. Amendment No. 3 would simply reinforce that special categories of personal data would not be processed under section 12. It is an issue of direct compatibility. I will find it difficult to understand if the Minister of State does not accept amendment No. 3, although my preference would be for him to accept amendment No. 2.

Amendment No. 4 provides for the insertion of the following words "where the information is disclosed [it must be] in accordance with the Act and compliant with Article 9 of GDPR". Where there are special categories of personal information, Article 9 of the GDPR becomes relevant and must be abided by. Another amendment proposes the insertion of the words "where the information is disclosed in accordance with Article 9 of the GDPR". These are literally suggestions.

I have also indicated that section 6 is opposed, an issue that will be discussed separately. I question if this is the appropriate place in which to deal with it. Section 6 refers to the public service dataset and specified bodies under the social welfare legislation of 2005. Many argue a social welfare Bill is the appropriate place in which to tamper with the terms of social welfare legislation and that we should wait for the next social welfare Bill to do so, especially given that the generality of this Bill deals with public bodies, whereas the social welfare Bill only deals with a closed set of specified bodies. I know that the Minister of State wants to put some of the other good practices in place and perhaps that might be the appropriate Bill in which to do so in the context of how specified bodies engage with each other. Giving him the benefit of the doubt, it is the only rationale I see for the inclusion of section 6 in this Bill, but if it is to remain in the Bill, it must be compatible with section 12 and, crucially, the GDPR. Currently, there is an incompatibility.

A particular concern arises in that regard, given that this is one of the issues being considered by the Data Protection Commission and which has been part of the debate on the public services card, on which we are still awaiting the decision of the commission. Amendment No. 3 has been phrased mildly in that it does not seek to anticipate what the decision of the commission might be.Amendment No. 2 is probably somewhat more specific and reflects what I believe is the correct interpretation. I ask the Minister of State for his observations on the amendments.