Alice-Mary Higgins (Independent) | Oireachtas source

I move amendment No. 19:

In page 14, line 37, to delete “250” and substitute “50”.

I believe there is a technical drafting error in the amendment, so I will withdraw it. I have to move it because the other amendments in the grouping are attached to it. Otherwise I probably would not move it.

Amendment No. 22 seeks to add a condition around the provision that employers with fewer than 250 employees may share resources in terms of the receipt of reports under this session. While I fully understand the desire to share resources, we do not want to get a kind of outsourcing of the reports whereby lots of companies move to a "problem go away" type of reporting structure. Everybody has been sent through one complaints structure to another to eventually land in a kind of box somewhere. We do not want dealing with reports and protected disclosures to become a problem-solving service that is provided for companies. Alternatively, we do not want to have smaller companies being permitted to say they are not able to do anything about it because they have people who do that and you need to talk to them. It then becomes a further piece of the labyrinth, which is exactly what we want and need to undo. We must also bear in mind that where protected disclosures have been made, it is not solely about individuals accessing their rights. These are matters of concern that are being highlighted in many cases with really significant impacts for society. It is important, therefore, that they are dealt with in a timely, transparent and trackable way.

My two amendments seek to add some conditions as I am a little concerned about what the sharing resources might look like. In the first amendment, I suggest they could be shared resources where it is a linked company or set of companies. Again, the accountability is there in that if it is with a linked company or there is a way of tracking the same parent company, for example, it will still be ultimately responsible if one of the companies under it may be sharing it. As such, the chain of accountability will not be lost into a chain of service provision. There could be an incentive for companies to provide instruction, which would allow other companies to avoid their obligations under the Bill.

Amendment No. 22 provides that where an employer shares resources and potentially materials around the receipt or investigation of a report with another company, as is provided for here, before such materials or resources are shared, there should be a data protection impact assessment in relation to the sharing of such resources. If a company receives a disclosure and then has another company deal with that report or disclosure, there are potentially important data protection impact concerns. This is especially so if we have a company receiving multiple reports from multiple other companies because then the question of firewalls and suitable practices arises. The amendment simply provides that there would be a data protection impact assessment where resources are shared in respect of the receipt and investigation of reports.

To make a general comment on GDPR, we know that with anything that has implications, a data protection impact assessment is appropriate.