Helen McEntee (Meath East, Fine Gael) | Oireachtas source

I am pleased to introduce the Communications (Retention of Data) (Amendment) Bill 2022 to the House. The purpose of the Bill is to make certain priority amendments to the current Communications (Retention of Data) Act 2011, referred to in this Bill as the principal Act. To comply with rulings of the Court of Justice of the European Union, the principal Act provides for the general and indiscriminate retention of certain categories of communications data held by communication service providers but not the content of such communications.

Senators will be aware there has been a civil challenge to the principal Act arising from a high-profile criminal case. While it would be inappropriate for me to comment on the specifics of any case before the courts, it is necessary to refer to some aspects of that litigation. A High Court order was made in early 2019, which declared invalid section 6(1)(a) of the principal Act insofar as it relates to mobile telecommunications. This section provides for disclosure of retained traffic and location data for law enforcement purposes. Following an appeal of this decision by the State, the Supreme Court referred certain legal questions to the Court of Justice of the EU. On 5 April this year, the Court of Justice delivered its ruling. In essence, the court confirmed that general and indiscriminate retention of traffic and location data is permissible for the purposes of safeguarding national security only. Such retention is not permitted for the prevention, detection, investigation or prosecution of a serious criminal offence. The court added that access provisions for traffic and location data must incorporate prior judicial scrutiny other than in certain urgent circumstances, and in such circumstances there should be a post review.

Following the Court of Justice ruling, the State's appealed proceedings against the 2019 High Court ruling regarding the principal Act were resumed in the Supreme Court. Following case management hearings at the end of May, the Supreme Court order for the outcome of the appeal is expected to be handed down in the near future. While I cannot comment further on these proceedings, the immediate impact of the Court of Justice ruling is that there is now a significant degree of clarity on what is and is not legally permitted in relation to the retention of traffic and location data.This has significant implications for communications service providers, An Garda Síochána and other relevant agencies. Communications service providers have expressed doubt as to the validity of continued general and indiscriminate retention of data currently held under the principal Act. They have called for legal certainty as to what their data retention obligations now are. In addition, An Garda Síochána and other relevant agencies require legal certainty as to the scope of their powers to seek disclosure of retained data for the prevention, detection, investigation or prosecution of criminal offences, for national security and other lawful purposes. As a result, I am proposing a series of urgent amendments to the principal Act, in advance of a more extensive reform of the law in this area. Apart from this Bill, it is my intention to publish an updated general scheme of a Bill before the end of this year, which will update and consolidate the law in this area.

In devising this Bill, I am seeking to balance a number of factors. First, I must adhere to the conditions placed on the operation of data retention by the Court of Justice while seeking to ensure that An Garda Síochána and other related agencies have effective and proportionate legal powers to support their vital role. Second, I must have due regard to the right to privacy of individuals and to the need for strong oversight of any data retention measures that are imposed. Third, I must at all times have regard to the needs of victims or potential victims of crime. There is a right to life and a right to personal safety of persons and, as Minister for Justice, I will always prioritise these rights.

I will now refer briefly to the main provisions of the Bill. Section 2 provides for a number of new definitions in the principal Act.

The term "user data" refers to general information regarding the user of an electronic communications service such as the mobile telephony number, the equipment identifier of the device used and the Internet protocol address in respect of the user. The Court of Justice rulings view the retention of these sorts of data as having a limited impact on privacy rights.

The term "Schedule 2 data" is intended to capture traffic and location data and is based on the type of data that is already retained by service providers under Schedule 2 to the principal Act. The Court of Justice rulings view the retention of this type of data as constituting a significant interference with privacy rights.

The term "internet source data" is a category of data already that can be used to identify Internet protocol addresses which may have accessed unlawful online content such as child abuse imagery. The retention of such data for both national security and other purposes is not precluded by the Court of Justice rulings.

Section 3 provides for an obligation on service providers to retain user data for a default period of 12 months. In this Bill, it is necessary to segregate the procedures governing retention of and disclosure of user data from the same procedures governing Schedule 2 data. Provision is made for this period to be varied to less than 12 months or a maximum of two years on stated grounds as the Minister may consider necessary or proportionate. This option is included as there are pending Court of Justice rulings on the issue of data retention periods for this type of data.

Section 4 introduces two new sections into the principal Act. The new section 3A provides for amendments to the current rules on general and indiscriminate retention of Schedule 2 data. Such retention can only be permitted for national security purposes and where there is approval of a High Court judge. It will no longer be permitted for law enforcement purposes. This is a change from the current arrangement in the principal Act, which allows for general retention for both of these purposes. I wish to clarify the background to this measure. Confining general retention of Schedule 2 data to national security purposes is a requirement of the Court of Justice rulings. While Ireland and a large number of other EU member states made strong legal arguments against making such a distinction in the relevant legal proceedings before the Court of Justice, the Court did not accept these arguments. I respectfully disagree with the Court of Justice ruling in this respect. However, our laws must reflect the legal outcome and that is why this amendment is proposed. I will, however, continue to advocate at EU level for an EU-wide legal instrument that will support strong general data retention measures that deal with both national security and law enforcement concerns.

The new section 3B provides for a stand-alone obligation to retain Internet source data for a default period of one year. Provision is also made here for this period to be varied to less than 12 months or a maximum of two years, due to pending Court of Justice rulings.

Section 5 amends section 6 of the principal Act to confirm the authority of An Garda Síochána, the Defence Forces, the Revenue Commissioners and the Competition and Consumer Protection Commission to seek the disclosure of user data for national security, crime and for protecting life or personal safety. The provision reflects what is permitted by the Court of Justice rulings.

Section 6 provides for the insertion of new sections 6A to 6F into the principal Act. Section 6A provides for a disclosure regime for An Garda Síochána and the Defence Forces to obtain access to retained Schedule 2 data on national security grounds, provided the disclosure has been approved by an authorising judge.

Section 6B provides for a disclosure regime for An Garda Síochána and the Defence Forces where there may not be time to seek approval by an authorising judge. A system of post-approval by an authorising judge within a set period of time is also included.

Section 6C provides for a regime of disclosure of retained Internet source data to An Garda Síochána, the Defence Forces, the Revenue Commissioners and the Competition and Consumer Protection Commission on both law enforcement and State security grounds, where approved by an authorising judge.

Section 6D provides for a disclosure regime for Internet source data in urgent circumstances.

Section 6E provides for a disclosure regime for An Garda Síochána to access cell site location data linked to an electronic device in urgent circumstances, where needed to protect the life or personal safety of a person or determine the whereabouts of a missing person.

Section 6F provides for a single legal obligation on service providers to comply with the requirements to disclose data.

Section 7 provides for the insertion of new sections 7A to 7D into the principal Act. These sections introduce new legal provisions for preservation orders and a protection order to be sought in specific cases by An Garda Síochána, the Defence Forces, the Revenue Commissioners or the Competition and Consumer Protection Commission. The orders must be approved by an authorised judge and based on the need to respond to serious offences, national security or the saving of a human life. The possibility of deploying such measures to ensure the expedited retention of specific data in individual cases has been acknowledged by the Court of Justice in its rulings.

The new section 7A provides for a preservation order, which will require the preservation of specified Schedule 2 data by a service provider in connection with specific persons, locations or other indicators, for example mobile phone numbers. A preservation order will not in itself require the granting of access to data. The new section 7B provides for a production order, which, if approved by an authorised judge, will require the submission of specified data to An Garda Síochána and other agencies, and may include data which may already be the subject of a preservation order. The new sections 7C and 7D allow for the approval in urgent cases of temporary preservation and production orders by an appropriate senior official in each organisation, which must be notified to an authorised judge for affirmation within 72 hours.

Section 8 provides a number of supporting measures to be included in the principal Act, including an offence provision for failure to comply with a requirement to comply with legal requirements to retain, preserve or disclose data, the issue of guidelines to service providers, the making of regulations, the notification of data subjects in appropriate cases where their data have been disclosed, and the appointment of authorised judges.

Section 9 is a transitional provision that allows for a time-limited period where there can be disclosure, on national security grounds only where approved by an authorised judge, of Schedule 2 data already retained under the existing 2011 Act until the earlier of the expiry of a period of six months or the making of a first order by a designated judge under section 3A permitting the future retention of Schedule 2 data.

I look forward to hearing the contributions from Senators today. There will of course be an opportunity on Committee Stage to discuss in more detail any aspects of the Bill that Senators wish to explore further. I acknowledge the speed at which this Bill has come to the House. This is not the way I like to bring forward legislation. I stress that this is emergency legislation because of the fact that once we go on Dáil recess there will most likely be a final ruling, which would mean that certain aspects of the Act will fall. This provides a huge amount of uncertainty for the communications platforms and for An Garda Síochána. This is a measure to put into place to ensure that we have certainty for those various authorities. I also wish to confirm with and assure the Senators that I will be bringing forward the general scheme of a Bill for a more broad discussion later this year. I look forward to discussing and debating even more with the Senators then.