Alice-Mary Higgins (Independent) | Oireachtas source

I move amendment No. 75:

In page 38, line 3, after “data” to insert “, where necessary and proportionate”.

These amendments seek to ensure that the actions the commission may take are fully true to the letter and spirit of our obligations under the general data protection regulation, GDPR. Personal data may be disclosed to a number of different bodies. I am trying to ensure in amendment No. 75 that it would be very clear that it was only to happen where that is necessary and proportionate. I recognise there are some further caveats, which I will come to, in the section. In effect, the necessity and proportionality tests are important.The tests slightly differ and do slightly different work.

On amendment No. 76, the Bill states: "The Commission may ... disclose personal data to ... (d) a broadcaster or a provider of an audiovisual on-demand media service", where a person has made a complaint under section 33(2). It is not clear to me why the personal data of the person who is making the complaint would be disclosed because either the complaint has merit so needs consideration or it does not. In terms of disclosing the complaint, this is not an interpersonal thing but people who do a public service by making a complaint, and we also have this in terms of the whistleblower legislation. It should not be the case where persons are concerned or feel concerned enough to make a complaint. For example, one may have situations where persons may be the employees of a body yet wish to make a complaint about some of its practices or persons who have had business dealings in any form. I am concerned about the sharing of personal data, and especially given that we know the vulnerabilities of individuals versus the immense power of some of the actors who will, potentially, be regulated with this provision. As the Minister will know the individual complaints mechanism is something that we really need to be part of this legislation. Again, I would not want to have anything in the Bill that has the potential to impinge on such an individual complaints mechanism when we put it in place.

Amendment No. 77 seeks the deletion of section 33(e). Again, this is quite an immense power that is given by the Minister because the Bill states that the commission can disclose personal data to "a body prescribed in regulations made by the Minister". Again, I am not comfortable with us, as a Legislature, giving the power to not just the current Minister but any future Minister to prescribe that any body should have access to personal data and that the commission would share it, including, potentially, any private body or actor in that context. The provision is not even constrained to a public body in that sense.

Amendment No. 78 concerns 33(2)(d) whereby the commission may transfer personal data "to the broadcaster or provider of an audiovisual on-demand media service ... for the purposes of transferring the complaint". I am concerned about the provision as follows. If persons wish to make a complaint to a broadcaster then they can do so as there is a range of imperfect mechanisms across different broadcasters or providers of on-demand services. If a person wishes to make a complaint to the commission then he or she is making a complaint to a public body so should enjoy all of the associated protections and safeguards and I am concerned about the transferring of that information. Again, it is not clear to me that such transfer would only happen, for example, with the consent of the complainant. I think that would be a necessary and an appropriate bar in that regard.

Amendment No. 79 is similar. It says that perhaps there may be circumstances where it is appropriate to transfer but that transfer should be done explicitly with the consent of the relevant complainant. The amendment recognises that a transfer may be anonymous because it states: "having made all reasonable effort ... to contact and seek the consent of a relevant complainant". Simple efficiency or easiness for a public body does not meet the necessity and proportionality tests.

Amendment No. 80 seeks to insert a new subsection (2A), which makes it clear that where a person's personal data has been disclosed, under any of the provisions of this section, every reasonable effort shall be made to inform the person that his or her data has been shared. That is sought because otherwise one has the situation whereby somebody shares information with the commission and his or her personal information is shared onwards yet the individual may not be aware of that fact. My concerns are not solely confined to whistleblower scenarios but they are a good example whereby we know there are protections. I mean we know that there is a long record of punitive measures, of targeting and other ways that persons may be targeted. If somebody is not even aware of a complaint then he or she is operating blind. Such a person may be vulnerable to situations, cases or other actions, yet not know of his or her vulnerability so thus are unable to take appropriate measures for self protection or exercise his or her rights against penalisation.

Amendment No. 81 seeks to insert a new subsection (5A) which states: "Prior to making regulations under subsection (1) or subsection (2), the Minister shall subject the proposed regulations to a data protection impact assessment". We have gone through a lot of data protection impact assessments. It is simply not enough to have the legislation or bodies at a core point because regulations, if any, should be subjected to a specific data protection impact assessment in terms of their potential effects.