Alice-Mary Higgins (Independent) | Oireachtas source

We had an initial discussion on this in which I highlighted my concerns regarding amendment No. 23. I said that while I knew there were concerns within the specifics of the proposal put forward by Sinn Féin colleagues, I explained the understanding and reason people have for not wanting it to be limited, but wanting to name many forms of personal data. It is from a long record of a minimalist approach to what gets shared, and that is where that very long and comprehensive definition comes in. I would perhaps urge the Minister, if he is not accepting that amendment, to consider and review the forms of personal information. It is worth checking that they are, in fact, all covered under other the provisions because I do not believe all of them might be.

The other amendments were in respect of the question of the Minister putting in place suitable and specific measures. At the moment, it is suggested that the Minister may, but there are quite significant powers for processing under the Bill, which I know is necessary for the agency and the Adoption Authority of Ireland, AAI. Indeed, there are specific clauses in the Bill in terms of curtailment of some of the specific rights under general data protection regulation, GDPR.It would be appropriate for suitable and specific measures to be set out, as is usually is the case. As I highlighted, one form of processing is deletion so it is important that the Minister, in empowering the authority and the agency to process data, sets out suitable and specific measures to safeguard the rights of data subjects. One example of what might go into such measures is a specific provision preventing anything that might constitute excessive redaction, deletion or so forth. I know that is the Minister's intent but it is important that it be set out in the Bill.

On amendment No. 125, the Minister has been very clear that it is not his intention that Article 15 rights be constrained by the Bill. As he has rightly stated, Article 15 does not grant an automatic right to information but a right to request information. However, as I identified, there are provisions within the Bill that seem a little at odds with that intention. One I consider important relates to the name of a person who has inquired about someone. That is the kind of thing a person might make a data subject access request, SAR, about but the Bill explicitly prohibits sharing the name of a person who has made inquiries. Rather than balancing being done around that request from an individual, the Bill is saying one thing while GDPR rights under Article 15 say a different thing. This amendment would avoid any lack of clarity by stating that in such a situation a person's right under Article 15 would not be in any way constrained by the provisions in this Bill. I appreciate that Article 15 is not one of the articles of the GDPR named as being constrained but there are provisions in this Bill that could potentially be at odds with the exercise of Article 15. That is why it would be appropriate to clarify this, possibly by attaching a simple clause where curtailment has been indicated stating that no other article of GDPR would be constrained by any aspect of this Bill. We do not want people to have to duke it out between national legislation and European law. It would be better if that were clarified and the precedence of European law in that case were made clear.