Alice-Mary Higgins (Independent) | Oireachtas source

I move amendment No. 8:

In page 8, line 26, after “other” to insert “public”.

My set of amendments, to which the Government has tabled amendments in response, relates to section 5. Before I get into a detailed discussion of the amendments, I note that I was an English language teacher myself for four years and am looking forward to that part of the debate.

This part of the debate is very important too because it relates to data. A huge quantity of information and data will be going through QQI. At present, the language in the Bill is quite fast and loose in terms of how data will be gathered and shared. In respect of the furnishing of information by the authority to other bodies, the text currently states that subject to the Data Protection Act, the authority may furnish to a Department of State, the Revenue Commissioners, the CAO and various other bodies, and "any other body" the authority considers appropriate, "information which comes to its attention in the course of performing its functions". This section is giving the authority permission to share anything with any body. The Bill refers to anything which comes to the authority's attention. The language used is incredibly vague in the context of data protection. It is extraordinarily wide and goes against the spirit of anything we are doing now in the realm of data protection, where information is shared only for particular purposes. It is no longer acceptable for found information to be shared at will with whomsoever one deems appropriate.

Amendment No. 8 is very short. I recognise that because it is counter lapped by Government amendments which may be passed, if I press it today, it may be overtaken by a later Government amendment. In that context, I may choose to withdraw and press it again on Report Stage. Either way, I will be pressing it because it provides the most basic brake on what is being offered here. It simply says that data should be shared with any other "public" body rather than just any other body. As it is currently constituted, the section gives the authority permission to share any information that may come to its attention with any other body, whether private or public. Thus data can be shared with companies, outside actors, lobby groups and so on. Whether such sharing is appropriate is left to the authority, with no safeguards or guidance. There is no caveat that this refers only to public bodies, over which we might some measure of control.

In terms of the sharing of data between public bodies, legislation is currently on its way through the Oireachtas by way of the Data Sharing and Governance Bill 2018. The Bill before us today is pre-empting that legislation and giving permission to share data, even though the Government, in putting forward the Data Sharing and Governance Bill, acknowledges that public bodies do not currently have a legal basis for the sharing of data with one another. The Data Sharing and Governance Bill is being pushed forward because of anxiety around the lack of a proper legal basis for data sharing among public bodies. That Bill has not yet passed and here we are, jumping the gun with yet another example of an authority being given permission to share data. Moreover, when the Data Sharing and Governance Bill came through this House, the Minister of State, Deputy O'Donovan, accepted a number of amendments.These amendments were not forced on the Government, but accepted by it because it accepted that they were in line with good practice. It is now proposed to remove many of those amendments that were accepted on Report Stage in the Seanad on Committee Stage in the Dáil. We have a real concern that the Minister of State, Deputy O'Donovan, stood here, said the Government was very conscious it had legal obligations, accepted a number of amendments to ensure the better functioning of the Data Sharing and Governance Bill and is now proposing to remove these.

I will give one example that should be of concern to any parliamentarian. It was agreed that a data-sharing agreement between public bodies would be published and available for an Oireachtas committee. We are not talking about the information the two public bodies share, but just the data-sharing agreement which outlines that data are shared and how they are shared. The Minister of State, Deputy O'Donovan, agreed that those data-sharing agreements would be published. Tomorrow in the Dáil he will propose to remove that eliminating the need to publish agreements about data being shared between public bodies. It is really concerning that that legislation is not yet passed and is being pre-empted here, and also that that legislation is now looking extremely ropey if the Minister of State, Deputy O'Donovan, presses ahead with rolling back on those provisions.

In that context I must oppose the section. I note that the language of a data-sharing agreement is not even used in this. There is not even a precursor to a data-sharing agreement, which could, of course, be supplanted if the later quality legislation came in.

Amendments Nos. 10 and 11 attempt to deal with this. Amendment No. 11 puts forth a very basic form of a data-sharing agreement which sets out what are largely regarded as good practice internationally and in line with data-protection law. Therefore, if QQI is sharing information with other bodies it must: put in place a data-sharing agreement, which is not required at the moment; publish that agreement; consult with data subjects who may be affected given that this is their information; and ensure there is appropriate regulation for how the data are stored and processed. We have talked about a fast and loose environment in some of these institutions and we have real concerns about how people's data are minded. The amendment also requires that any information shared is not simply what comes to their attention, but that whenever information is shared it is done for a reason and is proportionate to that reason.

I apologise for the length of my contribution, but this is a substantive issue. I acknowledge that the Government amendment No. 13 removes personal data somewhat from the impact of this section. However, I will still press amendment No. 11 because the main language on page 8, lines 26 to 32, is still highly flawed and far too loose. We may have an opportunity to engage on the language in that section before Report Stage.