Rónán Mullen (Independent) | Oireachtas source

The data protection regime that has grown up over the past two decades is, generally speaking, a good thing. Like State regulation of any area, however, it has its downsides. The nature and scope of data protection obligations are complicated, to say the least. One downside is that GDPR is often invoked to deny citizens access to information to which they are entitled. We have all encountered such cases. Ordinary people and small voluntary organisations are also not certain of their obligations. I know of more than one local community organisation that has been reluctant to communicate with its own members by email or group text because it believes that doing so would be a breach of GDPR. Clearly, that is not the case, but we will see more GDPR issues arising in respect of WhatsApp groups, Zoom calls and so on.

The Office of the Data Protection Commission is overworked and understaffed, with people waiting ages for a reply to even a standard query. The issue under discussion arises from a Data Protection Commission investigation into the use of CCTV by a local authority, where the commission found that the Waste Management Act and the Litter Pollution Acts did not sufficiently define in law the policy objectives that made the use of the CCTV footage legitimate for the purposes of prosecuting littering offences. We must accept that conclusion and, therefore, I support the Bill.

CCTV is already used effectively, and to an increasing degree, in criminal trials. We saw in the trial of the killers of Patricia O'Connor how a next door neighbour's private camera was crucial in securing convictions. Strictly speaking, under the Ryneš decision of the Court of Justice of the European Union, footage recorded by a private camera of events on another person's property should not be admissible because it does not come within the so-called domestic use exemption. If I make a CCTV recording on my own property, I am not a data controller for the purposes of GDPR and the control, storage and retention of that information by me is not regulated by law, but any recording of areas outside my property is essentially viewed as having been recorded without any legal basis. However, the Irish courts seem to accept such recordings as evidence in criminal cases despite the Ryneš decision, which is a good balance.

We face increasing issues with new technologies. There has been a proliferation of dashcams, owned by taxi drivers, capturing accidents, near misses and so on. I believe the DPC has indicated that, because these cameras face onto a public thoroughfare, they do not meet the domestic use exemption and, therefore, a taxi driver would have responsibilities in terms of retention and storage of data. That would seem a bit absurd.

We have increasing anecdotal evidence of drones being used to fly over private properties to gather information ahead of burglaries. In Oranmore, Tesco and others have been using drones to deliver products to people. I often wonder whether one would be entitled to shoot a drone down if it passed over one's property on the way to deliver a birthday cake.

These matters are well outside the scope of the GDPR, but the Minister of State may wish to comment on the fact that we will have to face up to issues that do not appear to be covered by the law. Regardless of EU law considerations, there are all sorts of connected issues arising to which the Oireachtas will have to turn its attention sooner or later for the sake of the common good.