Mary Seery Kearney (Fine Gael) | Oireachtas source

I appreciate that this is a technical motion, but while the Minister of State is here, I will use this opportunity to raise a concern based on my experience over a number of years. I work with many families on a pro bono basis, assisting them when they have been done out of tracker mortgages, restoring them and going through that with various financial institutions. One of the provisions of the GDPR is transparency and modalities, meaning that data subject access requests should be responded to in the most convenient and quickest way possible. However, in my experience it takes a lot of work and many letters to ensure that transparency is put in place. To be fair, the Data Protection Commission is fantastic in supporting people and being very clear about this. The threat of recourse to the Data Protection Commission is always a paragraph within my letters. First, one gets the data on a disc or in some other form but it is programmed by the financial institution so that it cannot be unpacked or accessed. Then when one writes to the institution again, it provides a package to access the disc on one's own computer. By the time one goes back to it to talk about the provision for transparency and modalities in the GDPR, it is six months down the road. During that time people will still have been paying their mortgage or been caused hardship by not paying, and so there is an increase of arrears and further things to negotiate and talk about. We get there in the end but I wanted to put on the record the fact that we have that process at all. I would appreciate if the Minister of State could exert some influence on that process if the opportunity arises.

Financial institutions' data protection impact assessments, DPIAs, should be published as well rather than just a privacy notice. The privacy notice is the external mechanism by which the information about how people's data is handled is published and made available. That is not enough when it comes to the necessary and proportionate restriction of data subject rights. The DPIAs of both State entities and financial institutions should be made public. They should be transparent if institutions are going to restrict my rights, the rights of a constituent or anyone else. Generally, by the time people exercise their rights it is because they are engaged in some sort of an argument with the banks. People will not know and will not have looked for their statements because they have not had an argument with them in a while. People in that situation are already vulnerable, so the DPIAs should be made available in order that people like me and others who assist families in such situations have complete transparency. We can then measure expectations rather than having to go through the arduous process of eight months of letter writing before getting to the nub of why we are not getting the information. I thought I would take the opportunity to mention that while the Minister of State was here.