Alice-Mary Higgins (Independent) | Oireachtas source

This suite of amendments largely relates to the question of GDPR and how it intersects with this legislation. The Minister will be aware that we have had lengthy discussions on the general data protection regulation. Some of my very first discussions on this were back in 2018 when that regulation had come into effect. There has been a very long journey of understanding the implications of the GDPR within all of the relevant bodies, including Tusla, the Adoption Authority of Ireland and the Department. The GDPR changed things and created a hierarchy where we have an EU directive in EU law, which is applicable and cannot be eroded. It is important that there is not even a perception that national legislation could give rise to a conflict with or limitation on GDPR. Amendment No. 23 is not my amendment but I recognise that it is an attempt to provide the widest possible definition of personal data and bring what constitutes personal data in line with the GDPR definition of personal data. It is trying to address the specific situation.

While not excluding other provisions that may be inserted - we cannot always be completely exhaustive - these amendments attempt to be more exhaustive than the Bill itself sets out to be. The desire to be as wide and comprehensive as possible arises from the experience that a minimalist approach has been taken to providing access to information. While I understand the Minister's experience and perspective and his desire in terms of culture, there is a very deep and long-established culture of taking a minimalist approach to information. The Minister will know this because we have encountered it again and again. Despite revelations and changes in terms of realisation, people still have the feeling that they are trying to get blood from a stone. That is shifting and having such a comprehensive list, as I understand it, is an attempt to help that shift. These are the starting points of things that must be considered.

My other amendments in this group are intended to copper-fasten. Amendment No. 103 seeks to ensure that among the information the authority is required to provide to people requesting information is information on their rights under GDPR. Not everybody would be aware of that. This would mean that persons accessing their rights under this legislation would also be made aware that they have rights under the GDPR. The amendment provides that when the authority is making an entry in the register and informing persons, it would inform the persons of the legal basis under which their personal data are being processed and would also inform people of their rights in relation to the general data protection regulation. This information would be included in the conversation the authority might be having with such persons.

As regards amendments Nos. 124 and 125, the Bill states that the Minister "may prescribe suitable and specific measures". The Minister should be prescribing suitable and specific measures around the process, especially in terms of safeguarding. Under the Data Protection Act, suitable and specific measures are a requirement when permissions such as those provided for in section 66 are being given, for example, where the Minister is authorising a number of bodies in relation to the processing of personal data.Deletion is recognised as a form of processing. I am not suggesting that deletion would meet the necessity and proportionality standard, but the reason there are special regulations for the Minister in terms of suitable and specific measures is to copper-fasten it so it is not solely left to these bodies to interpret what is necessary and proportionate. Other suitable and specific measures are being put in place as a safeguard. I urge that the Minister would definitely do that rather than the Minister may do that.

Finally, regarding amendment No. 125, it should not really need to be stated but it is important to include: "Nothing in this enactment shall be construed as infringing upon or limiting the right of a person to make a data subject access request under Article 15 of the General Data Protection Regulation". We have already identified in the course of the debate areas where, in fact, people are entitled to information under the GDPR in terms of a subject access request and it would be very important that a narrower set of rights or concerns is not being substituted or even perceived as being substituted for that. I gave the example of the person who inquired about a relevant person. I believe that somebody would be entitled to that information in a subject access request. If the person makes a subject access request under Article 15, he or she would be entitled to have that considered directly under EU law in Article 15. The fact that there is national legislation which sets out a more constrained version and says the name shall not be given as a blanket provision, which one cannot do, would be subsidiary to the person's right to make a subject access request of that body under Article 15. As I said, there is a danger of a national law being potentially in conflict with the exercise of rights under GDPR.

I am concerned that section 66 may be seen as the process being the denying or redacting. What I want to be copper-fastened is that it is not an effect of section 66, combined with narrower provisions here and there, that effectively we have this legislation serving to constrain rights under Article 15 of the GDPR in terms of subject access requests. Of course, there are lots of other rights under GDPR, but it is because there is that danger that I am seeking to insert a reminder of it. Again, there is an argument for not simply mentioning Article 15 of the GDPR, but mentioning the GDPR more widely. I would be open to that because the Minister specifically mentions restrictions in respect of Articles 12, 14, 18 and 21. Those are explicitly restricted. Article 15 is not explicitly restricted but it could potentially come into conflict with some of the provisions in the Bill or what it provides for could be different and wider than what is allowed for. I mentioned the example of the redaction of a name of a person who inquired after a relevant person. That could be in conflict with the proper interpretation of Article 15.

Does the Minister see where I am coming from? I am a little concerned about us creating problems down the line. We have been getting things wrong in this area for a while and I want to ensure we do not set ourselves up for further conflicts and ambiguities, or even the perception of conflict between the two.