Alice-Mary Higgins (Independent) | Oireachtas source

Amendments Nos. 10 and 11 are coming at the same point. I am not sure if amendment No. 11 is necessary but I am seeking assurance from the Minister. I do not think I will need to press the amendments. It is my understanding that they may even be redundant but I want to know if that is the Minister's interpretation of the legislation because, if his interpretation aligns with mine, I do not need to press these amendments.

The amendments apply to the processing of the records by the agency. Parts of the database are compiled from related records that were given by other bodies, not the agency itself, and so forth. I would have liked if there was a positive framing in the legislation and if section 3 referred to circumstances "under which it shall be lawful", if the Minister knows what I mean, rather than how it is now worded. It is framed in the reverse at present, in that it refers to the restrictions on processing, rather than recognising there is a legitimate basis for it. The section is framed in such a way that it is not lawful to process records unless certain circumstances pertain. Section 3 states that processing records is not lawful:

... unless the processing of any such part, any such related record or any such information is—

[...]

authorised or required by or under the Data Protection Regulation, the Data Protection Acts 1988 to 2018 or any other enactment (other than this Act).

I wanted to be clear about the reference to "any other enactment". Is the Minister's interpretation that regulations that might be made under data protection regulations or the Data Protection Acts are also included? Are statutory instruments and other regulations that the Minister might make included? Statutory instruments might be made on one hand, while on the other, there are the capacities that the Minister is granted under the Data Protection Acts to make regulations in the public interest, subject to suitable and specific measures.

People have expressed many concerns about Tusla. One of my concerns about the agency is its interpretation of the general data protection regulation, GDPR. We have talked about whether new legislation is needed, and the Minister spoke about new legislation and information tracing during the discussion of the previous section. There is considerable scope for the use of statutory instruments and regulations under the Data Protection Act prior to the introduction of new legislation on information and tracing. There is provision under the Data Protection Act for the Minister to allow certain forms of data processing, indeed to waive some of the restrictions on dealing with personal data, where it is in the public interest and, of course, subject to necessity, proportionality and what the Data Protection Act describes as "suitable and specific measures". There is a suite of appropriate options that the Minister may apply. There is already a mechanism for the making of regulations that may address these issues. I am concerned because it seems that Tusla's interpretation has consistently been that things can only be changed through primary legislation when, in fact, a large amount could be done without primary legislation. I have been frustrated, specifically on the tracing issue, when representatives of Tusla have said they were unable to get a document from another body because of GDPR. It is using GDPR in a short and abbreviated way. GDPR is not mainly about privacy and secrecy but is, rather, empowering legislation. It is about empowering appropriate access and use of data, tracking it and ensuring transparency in how data and information are used. It is not intrinsically designed as a brick wall or an instrument of privacy.

I have submitted these amendments because I want the Minister to confirm that his understanding of "Data Protection Acts" encompasses the regulations he might make under those Acts and that his interpretation of "enactment" encompasses statutory instruments such as he might make. Those are two tools that the Minister has at his disposal. To be frank, information and tracing legislation will be complex and take a couple of years. There will be circumstances in which people cannot wait for information. We need to ensure they do not hit a brick wall with Tusla, especially if it is to hold the records and the database, between now and the enactment of such legislation. Tusla cannot state that there is nothing that can be done and tell people to wait for the legislation. There are things that can be done to address specific concerns which may be relevant. That may also apply in the case of the next amendment proposed by one of my colleagues, but I will not speak to that now.