Roderic O'Gorman (Dublin West, Green Party) | Oireachtas source

Senator Boyhan raised the important point of the information about vaccine trials that were done and, as we know now, done without consent and often in breach of what were the medical guidelines of the time, which I believe were the Nuremberg guidelines. It is a source of great concern for many people who were in mother and baby or county home institutions or other institutions. As Senator Seery Kearney said, vaccinations are explicitly listed in the definition of "early life information" and they are implicitly also covered by the term "medical information". Those definitions are in section 2, but there is a right to early life information set out in section 11 and a right to medical information in section 15. As we said previously, it is a right to the information and also the records. It is not just confirmation that somebody was subject to a vaccine trial and that is the end of it. The person is entitled to the records of that vaccine trial as well. We explicitly reference this on the face of the Bill so I hope that provides reassurance, and I hope the processes set out here will look to provide information from the bodies covered here. Separate processes are under way with some of the corporate bodies, the successors of companies that undertook these trials and may still have information.

With regard to the significant amendment proposed by Senator Warfield, I cannot support amendments Nos. 23 and 24 as they are seeking to insert a definition of "personal data" in the Bill. It is a lengthy definition and has 46 different elements. The vast majority of these examples of personal data are already encompassed in the definitions we have legislated for in the Bill. The vast majority of the items and the types of information covered in the list in the proposed amendment are covered in the definitions of "birth information", "early life information", "care information", "medical information" and "provided item". There are a couple of exceptions. The definition also contains a number of subsections that could not be considered the personal data of a relevant person. That includes personal information about the circumstances of a mother prior to the birth of a relevant person or after an adoption took place. That is not information directly relevant to the relevant person, so that is why we would be concerned about them.

Along with the list, it is also important, and Senator Higgins touched on this, that we are not even modelling but directly defining "personal data" in this legislation according to the definition in the GDPR. The definition section states clearly that the term "personal data" in this legislation is given the definition that is given in GDPR.That is deliberate because that definition, as contained in the data protection regulation, will change and be enhanced and probably be broadened by rulings of the European Court of Justice. While this definition is lengthy, it will remain the definition until such time as it is changed by subsequent legislation, whereas if we use the definition of personal data as it is set out in the GDPR, as soon as the European courts change that definition, our understanding of that definition changes and broadens as well. I therefore have a concern that what is proposed here actually fetters the definition of personal data and could, in the medium term, lead to personal data being defined by the GDPR and European courts in one way and personal data as defined for this one piece of legislation not having moved with the times and not having broadened as the definition. That is not something we would like. All pieces of information that are listed in this amendment and are legally permissible to be provided are already provided within the Bill as it stands. I have a real reluctance to go down the route of giving a conclusive definition of personal data because that would result in a kind of bifurcation between the definition of personal data here and that contained in EU law.

Amendment No. 103 proposes that when a person makes an entry into the contact preference register, he or she is told he or she can make a subject access request for all data held by the authority. I have a concern this will cause confusion because there are many people who apply to the register who would not have any personal data held by the authority. For example, a sibling or family member looking to register his or her name on the contact preference register has probably had no other engagement with the Adoption Authority of Ireland, AAI, before. To start telling that person he or she can do a subject access request now at this point would not be the best place. We are very clear and will discuss later on that there will be major information campaigns about the new legislation to make people aware of it. We will be very clear that those people also have existing rights under GDPR. For certain categories of people, that is very important, especially mothers. We will be making them aware. From engaging with groups of mothers, I am aware many of them were not aware they could already apply to many of the institutions for information about themselves. That came up during the joint committee hearings. Making sure that route is clear will be one of the things we hope undertake in the context of the information campaign.

I am reluctant to accept amendment No. 124 in terms of the Minister being obliged to prescribe in regulations safeguards to the rights and freedoms of others. This is a forward-looking provision. It is enabling and allows me or a future Minister to make those regulations as they are required. We should give that degree of freedom. GDPR is taken seriously and where they are needed they will be undertaken.

I move finally to amendment No. 125. To be very clear, the Bill does not restrict in any way a person's right to apply for his or her information through a subject access request. Article 15 rights are in no way interfered with. Article 15 continues to exist as a pathway. That is probably something we will discuss tomorrow as well but it continues to exist. There are a very small number of GDPR rights limited. As we know, the GDPR allows for the limitation of rights but they have to be clearly set out in legislation, and that is the purpose of section 65. There are a small number of rights that are limited and they are set out there clearly. However, the limitation is done in a narrow way and it is only to ensure the full operation of this Bill and, in particular, the fact release of information takes place in all circumstances because, as we know, under the GDPR the release of information is not guaranteed in every circumstance. Even with a subject access request under Article 15 there is the balancing test of the rights and freedoms of others. In our legislation we are working on here, because this information is seen as so vital, the legislative intent is to ensure the full release of all information on every occasion, and that is why we are going this route rather than relying on the GDPR. We did not want even one situation left where somebody could be refused access to his or her identity information on the basis of the rights and freedoms of others.