Patrick O'Donovan (Limerick County, Fine Gael) | Oireachtas source

We had a lengthy debate on Committee Stage on the application of this Bill to the sharing of special categories of personal data as defined under Article 9 of the general data protection regulation, GDPR. While it has always been the intention that the legislation would not provide a general legal basis for the sharing of specific special category data, I acknowledge that the text of the Bill may not have been fully clear that this was the case. Accordingly, I propose an amendment to provide for the insertion of a new section that explicitly states that the Bill may not be used for the sharing of special category data. That was one of the points Senator Higgins raised.

There are also a number of consequential technical amendments to remove various references to special category data that will be rendered redundant by the insertion of the new provision. There are three exceptions to the prohibition on the processing of special category data in the Bill. The first of these relates to the processing of data under Part 5 concerning public service information. In some cases, it will be necessary to process special category data under these provisions, for example, to record if a public servant has retired on health grounds. The second relates to the personal data access portal. This is so that users of the portal will be able to see what, if any, special category data on them is held by public bodies. That was a point a number of Senators and I raised the last night. The third relates to Chapter 3 of Part 9 concerning the prescription of rules, procedures and standards for data management. That is also an issue we had much conversation on in the previous debate. Such best practice standards should also apply to special category data.Senator Higgins has tabled several amendments on the applicability of the Bill to special category data. Amendments Nos. 3 and 82 propose that section 64 apply to special category data. I wish to inform the Senator that section 64 is not concerned solely with data sharing. Rather it is concerned with how all of the public service manages all of its data, including special category data. We may have a need, for instance, to prescribe strong binding standards for the handling of sensitive data, such as health data. If this amendment were accepted, this would not be possible. This cannot be what the Senator intended and I ask her to withdraw these amendments as I cannot accept them.

Amendment No. 5 would have the effect of making section 38 of the Data Protection Act 2018 apply to special category data. Section 38 does not currently apply to special category data so this would have a significant effect on the Data Protection Act.

Amendments Nos. 4, 5, 7, 8 and 9 are intended to exclude the application of specific sections of the Bill to special category data. These amendments are unnecessary, since the amendment that I am proposing to section 5 provides that the Bill does not apply to special category data, excepting for Parts 5, 8 and 9, for the reasons I have outlined and, given there is no need to keep restating that the Bill does not apply to special category data, I ask the Senator to withdraw these amendments.

Amendment No. 6 proposes that processing of special category data shall be subject to section 38 of the Data Protection Act 2018. I would like to inform the Senator that section 38 of the Data Protection Act relates only to the processing of "personal data" and does not provide a legal basis for processing special categories of personal data. Where special categories of personal data are concerned, the relevant provision under the Data Protection Act is section 49(b), which provides that subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where the processing respects the essence of the right to data protection and is necessary and proportionate, another issue raised here the last time we debated this, for the performance of a function conferred on a person by or under an enactment or by the Constitution. I appreciate that this is very technical but the debate the last night was technical. I apologise for going on a bit. This amendment could have the effect of amending the Data Protection Act to permit the processing of special category data under section 38. This cannot be what the Senator intended when she made this amendment and I ask her to withdraw it.

Amendments Nos. 7 and 8 proposed for section 6 relate to interactions with the Social Welfare Consolidation Act 2005. These amendments seek to clarify that any elements of the public service identity, PSI, data set that constitute special category data cannot be shared in accordance with this Act. From the outset, we have been clear that the Bill does not provide a general basis for the sharing of special category data. That is an important point. We are reinforcing this with the proposed amendment to section 5, which I am adding on foot of the Senator’s comments on Committee Stage. This means that in the event that any part of the PSI included special category data, it would not be lawful to share that data under this Bill.