Alice-Mary Higgins (Independent) | Oireachtas source

I have one concern, which is in respect of the data controller. I appreciate the concerns of the Attorney General regarding the wording and the need to avoid the implication that there is prejudice elsewhere. Nonetheless, in this legislation we are setting out a clear process whereby individuals can seek information and redress and a clear pathway whereby they should contact the lead agency. This applies in circumstances where there may be two or three data controllers or two or three different bodies that are sharing data and are party to an agreement under the GDPR. Obviously, a person can go to any one of those parties. However, if the concern was that we would be seen to close things off elsewhere, the fact that we specify how they can go to the lead agency and outline the steps to do that, without mentioning anywhere in the Bill that they can go to other data controllers, there is a concern about persons being even aware of that.

One of the obligations under the GDPR is to make sure that people can get practical access to information on how to exercise their rights. For example, if the Department of Employment Affairs and Social Protection was a lead agency in respect of a local bus service such as LocalLink, it should be the case that a person knows he or she can go to another body that may be much more local and more relevant, rather than believing the only route is to go to the lead agency. I know that, realistically, we will end up with a few lead agencies within very large networks. In the previous debate, the Minister of State mentioned potentially thousands of data sharing agreements. It is neither efficient nor satisfactory for persons to feel they have to go right to the top with a query when a smaller party to the agreement closer to them might be the relevant person to contact. This Bill does not take away their right to do that but our hope when we inserted this change was to make them aware that they can do that. If the Minister of State is removing that clarification which states that people can go to other parties and the four other signatories to this data sharing Bill, I ask him to indicate how he intends to ensure, first, that individuals are made aware that they can go to any of the parties in a data sharing agreement and, second, that the smaller parties in the data sharing agreement which may not be lead agencies are aware they have a responsibility to answer questions from individuals and do not simply shunt people up the line to a lead agency.