Alice-Mary Higgins (Independent) | Oireachtas source

As has been pointed out, the motion corrects an error but it points to several other key issues and I want to pick up on several of them. One is with regard to the points made by Senator Byrne. There is a concern about financial institutions and the quite disproportionate level of concern about data breaches with regard to financial institutions. I recognise the motion will make it easier to make appropriate investigations and act on them but it raises a related issue which, unfortunately, we will not be able to discuss in any great length when the Investment Limited Partnerships (Amendment) Bill comes through the House. I tabled an amendment which sought to ensure there would be a data protection impact assessment on how the register of beneficial owners would be used but I have just been informed that it has been ruled out of order. I have no doubt there is an intention to have a data protection impact assessment on how the register of beneficial owners might be used. It could be used in an inappropriate way. I have a particular concern because the register is being made a specified body under the Social Welfare Act 2004 and it is very important we would not have any inappropriate access to the single customer view data set, except for particular purposes which are important and necessary, such as investigation by Revenue and checking the confirmation of ownership. It is an example of how we need rigour with regard to all of the architecture of financial transparency. It has to intersect in a constructive and very transparent way with the architecture of data protection. This is an opportunity for the Minister of State to give assurance in this regard even though the amendment was disallowed. As regards a slightly wider issue, this is a reminder that it is possible to amend the Data Protection Act. Specifically, it is possible under the procedure being laid before both Houses to amend regulations made under that Act. I want to highlight that because sometimes the data protection rules are seen as very stationary but in fact, as has been recently discussed, there is quite a lot of power of interpretation. Under the Data Protection Act 2018, Ministers have the power to make regulations relating to the processing of personal data where necessary and proportionate in the public interest. We have talked a lot about Article 15 rights and people's rights to seek their own data but a Minister might also have powers, for example, relating to data on burials, deaths and so forth, and where that is in the public interest, regulations might be made. I am just pointing out that we have a system for this. Section 198 of the Data Protection Act, which is the section that amended section 39 of the Commissions of Investigation Act, may need review in the future.

Senator Ruane and I successfully inserted a few different sections into the Data Protection Act 2018. One of those was section 30, which relates to the microtargeting and profiling of children. As I understand it, we are dealing with a technical error here. There was a technical concern around the definition of "company or corporate body" within section 30 and, as a result, it has never been commenced. I emphasise that because we have the capacity under the Bill and through the statutory instrument process to apply a relevant definition of "company or corporate body" to section 30 which would then allow it to be commenced. It is a crucial issue. It is a question of the extent to which companies can profile children, as they are defined in section 29 of the Data Protection Act, and specifically target or even microtarget them. That section was a useful contribution. It may not have been perfect, much as section 60 may not have been perfect, but this is a useful reminder that motions could be brought by the Minister of State or another relevant Minister to fix this section in order that it can be commenced. It is an important issue and it has not been addressed in any other way since 2018.