Alice-Mary Higgins (Independent) | Oireachtas source

I thank the Minister. I am going to speak to his amendments and to my amendments to his amendments, which are grouped together. Given the time constraints, I am going to speak specifically to issues in these groupings but I reiterate that the manner, the timing and the sense of disempowerment that has accompanied this entire legislative process has been extraordinarily unfortunate and has been very traumatising for many people.

I acknowledge that when we were previously debating this Bill in the Seanad, four or five of my amendments related specifically to the point the Minister is addressing in amendments Nos. 1 and 7. I was calling on him to ensure he would have a copy of everything. The Minister may have taken on board some of the reasons it is important for him to have a copy of everything. The amendment relating to a potential future tribunal states that such a tribunal should be able to access all relevant documents in one location, as provided for under section 45, rather than having to go to two locations to seek the full suite of relevant documents. Tribunals may yet be needed in respect of the many appalling issues which have been uncovered in the process of this commission. In 30 years, when these documents may go to the archives, it will be important to point out about the related records that where records and their original copy are already into or past the 30 years, that of course should not delay them transferring to the National Archives. It is important for the Minister to emphasise that we are talking about the copies of documents that the Minister has and that there will be a full suite of documents transferring to the National Archives in 30 years.

My amendments to the Minister's amendments relate to the other key reason it is so important for him to have a full set of documents and to use them properly, which is the need to ensure that during the next few years, before the National Archives receive these documents, these documents cannot be sealed and are not sealed. A huge amount of the distress has been caused by the language of sealing. Unfortunately, it was the Government which introduced that language by saying it has taken the database out because otherwise it would have been sealed for 30 years. That language of sealing was introduced in a very unconstructive and negative way at that time. I know there have been some interpretations in the past around this being a seal and it is unviable and it is under the 2004 Act. We need to be really clear that the 2004 Act that after 30 years these documents will go to the National Archives. There is nothing in the 2004 Act that says nothing else can happen in the interim. That is not in the 2004 Act. There is nothing in the order of 2015 that established this commission that says nothing else can happen. What we have in the order of 2015 is simply that the commission had to provide for procedures for individuals who wished to remain confidential - not general procedures, but procedures for those individuals who wish to remain confidential during proceedings and subsequent reporting. That remit extends solely to the commission, its proceedings and its reporting. We have already discussed the balance the Minister has sought to strike, and I think we will get to discuss it again in the context of a later set of amendments. All of the documents the Minister receives, including these additional documents, the copies of the database, the copies of the relevant records and the other documents he had already been scheduled to receive, are subject to the general data protection regulation, GDPR. All of those documents will be subject to the GDPR not in 30 years' time but as soon as the Minister gets them. He will be the data controller and he will need to process those documents as required under the GDPR.That includes processing Article 15 data subject access requests. There will need to be processing of those and the Minister is going to have to respond to requests. The only caveat, which was not in the 2004 legislation, was brought in 2018, proving the fact that the 2004 legislation can be amended. In 2018 a new section, section 198, was inserted into the Data Protection Act, which was a new version of section 39, and suggested that Article 15 rights may be restricted to the extent necessary and proportionate to safeguard the operation of future commissions.

That is not a blanket permission to refuse requests. It needs to be addressed on a case-by-case basis. As the Minister receives requests, he must respond on a case-by-case basis to say that he is not answering a request to access personal data because if he did we would not be able to have future commissions. That is an extremely high bar. If it was not, it would be illegal. We know this from recent rulings made in respect of the Workplace Relations Commission, WRC, which stressed the point that any restrictions that might be placed on rights under the GDPR, must respect the essence of the right. Restrictions are, by their nature, restricted.

The Minister will be the data controller in respect of these documents. In anticipation of becoming the data controller, as he plans to be under the amendments he has moved, he will need to complete a data protection impact assessment, DPIA, on how he, as data controller, will deal with the database, the relevant records, and all of the other documents, how he will ensure that he will process them in a way that is compliant with the GDPR, and how he will address Article 15 issues. The interpretation of section 39 by the commission has been extraordinarily narrow. The Minister will have to make his own interpretations, which will have to be robust, and will have to do so on a case-by-base basis. In setting out the DPIA for all of the documents that the Minister is about to receive, as the data controller, he will also need to consult with stakeholders, because even storage is a form of data processing. Even if the Minister were not to process the data in other ways, although I believe he will, he would nonetheless need to complete a DPIA. I suggest that in the period between now and February 2021, the Minister really needs to address and engage with people on the issue of the DPIA, to ensure that he puts in place measures that guarantee that GDPR rights are being accessed and will be accessed.

My amendments, Nos. 2, 3 and 4, simply try to reaffirm that. The Minister has these obligations under law but I do not want to see individuals having to force him to fulfil these obligations. People have been through enough. The Minister should embrace his obligations. The amendments that have been tabled both in the Seanad and the Dáil were moved in an effort to provide the Minister with support in that, and to strengthen primary legislation to reinforce the fact of the applicability of the GDPR. This primary legislation is just as powerful as that of 2004, if not more powerful, because it reflects the full legal context including the EU context.

My amendment proposes that the Minister "shall put in place processes for the processing of the copies of relevant records and the database and records, along with such other documents as deposited with him by the Commission, under the Data Protection Regulation, including Article 15." This amendment is helpful, and it is something that needs to be understood. As a Minister, he is not simply appealing to officials and authority. We have heard the Attorney General being invoked, but that is advice that the Minister takes on board. The Minister operates within the constraints of the law, including the Constitution, not the advice of the Attorney General which is different from the constraints of the Constitution per se. The Minister also operates within the constraints of EU law etc. Within that, the Minister can make law, and it is a stronger tool for him, or it would have been. It is a missed opportunity that the Minister has not embedded procedures in this legislation, which include that not just him, but any future Minister, is paying proper attention to the GDPR.

My amendments do not seek to insert the GDPR into this legislation, rather, they try to insert action under the GDPR into it. I hope that the Minister will consider them and will do everything that he can to ensure that we do not put individuals through the appalling mill of having to individually seek to access their rights, and take their cases, which some will win, and others will die before their case is ever heard. Can the Minister clearly indicate that he understands himself to be a data controller in respect of these documents, that he will put in place proper procedures to take proper action as a data controller in respect of the full suite of documents, and indicate how he intends to move forward, including in terms of the completion of a DPIA and consultation with stakeholders around it, prior to him taking the documents in February 2021?