Patrick O'Donovan (Limerick County, Fine Gael) | Oireachtas source

With regard to whether or not we are being complacent, it is important to make a few points. The Senator spoke of the tests for necessity and proportionality. These are absolutely necessary and they are happening currently. Data is being shared at the moment, which is necessary and the agreements are necessary. They need, however, to have a legal basis, and hence this Bill.

Consider what is included in the Bill to cover proportionality, complacency and all the checkpoints and all the safeguards. There is public consultation and publication online. I am aware there is a later amendment on the timeframes that are allowed and whether or not there can be greater scope for that. This is certainly an aspect I am very amenable to.

On the agreements themselves there is scope around how the agreements are drawn up, who the lead agencies are and who the base registry holder is. Given that this is a data-sharing Bill that will cover public bodies we have also taken a lot of time to make sure the governance board would have the proper people to see that everything is done in accordance with the Bill. The data commissioner will be in the background and will have oversight on the laying of the agreements. The agreements will have to be laid before the Houses of the Oireachtas. The Minister will also be involved.

Senator Higgins alluded to hundreds of agreements. I believe there will be thousands of data-sharing agreements that will need to be registered. That will tell us the level of sincerity and commitment the Government has on the issue. This will take quite a considerable amount of resources. We shall do this to make sure the public has confidence in us to mind, supervise and use the data for the purpose for which it is collected. I agree that this has not always been the case. The Bill is being brought before the House because this lacuna in the law needs to be cleared up.

With regard to the lead agency and from the perspective of individuals who could be bounced around as the Senator has said "from pillar to post", the Bill makes it very clear that the lead agency must deal with the individual's request. The agency cannot try to send the fool further or send people around the houses from Billy, to Jack, to Jim. It does not prevent the citizen from going to the data commissioner. It also does not prevent the individual from using the provisions available to him or her for consultations to have his or her views heard. Given that the agreements will be laid before the Houses of the Oireachtas there will be opportunities for Deputies and Senators to make observations also. In fairness, there are an amount of safeguards included.

Discussion on amendments Nos. 13 and 16 went together. I want to refer to amendments Nos. 15 and 17, which are related. Amendment No. 15 proposes that a public body should, "demonstrate a consideration of whether there is a need for a data protection impact assessment". As I have said, the Bill must comply with the GDPR. Article 35 of the GDPR sets out when a data protection impact assessment must be carried out. It is in the law already. The Bill provides, at section 18(1)(h), that where a data protection impact assessment has been carried out, a summary of the assessment must be provided in a schedule to the agreement. This is in accordance with the guidance on data protection impact assessments issued by the European Commission’s Article 29 data protection working party. The Senator’s amendment proposes an additional requirement on public bodies that they would provide an explanation in the data-sharing agreement of what they considered in deciding whether or not to carry out an assessment. This is not required under the GDPR and I do not consider it appropriate to oblige public bodies to go further than the GDPR in this regard.

Amendment No. 17 concerns the role of the data controller as specified in section 20 of the Bill. This refers to lead agencies.This section requires one of the parties to the data-sharing agreement to be designated as the lead agency responsible for carrying out the functions specified in the section and elsewhere in the Bill. It sets out a number of functions that the lead agency will have, including dealing with requests made by data subjects to exercise their rights under the GDPR.

As I have mentioned a number of times, data sharing that takes place under the Bill must comply with the GDPR which is being transposed. The GDPR sets out the rights of data subjects and this section of the Bill does not override those rights; it serves to extend them by providing that the lead agency is obliged to deal with requests made by data subjects to exercise their rights under the GDPR. In other words, the Senator will not be sent around the houses.