Eamon Ryan (Dublin Bay South, Green Party) | Oireachtas source

On Committee Stage we discussed some of the data-protection measures in the new section 77A, which the Bill will insert into the Road Traffic Act 1993 to deal with traffic cameras and other devices. I thank Senators Ruane and Higgins for drawing attention to the important issue of data protection regarding the use of cameras and other devices on our roads. I believe we are in agreement on the principles of protecting personal data and making sure that the technology cannot be misused. I remind the House that any processing of personal data is already subject to the Data Protection Act. We will discuss that further when we come to talk about facial recognition technology in a later amendment.

This group of amendments relates to provisions of the Bill to allow for regulations adding further data-protection measures over and above existing law. On Committee Stage, Senators Ruane and Higgins raised the fact that the additional data-protection regulations were made optional, in that the Bill stipulated that they "may" be made rather than that they "shall" be made. I have re-examined the Bill in light of that discussion and that has led me to propose amendments Nos. 30 and 37. Section 77A(6) allows for regulations for sharing by local authorities and TII of the data obtained from traffic cameras and other devices.Section 77A(7) says these regulations may include further data protection measures. On reconsidering the issue, in light of our previous discussions, I propose in amendment No. 30 to change "may" to "shall". This means if regulations are made on the sharing of data, they will have to include the additional requirements of section 77A(7). I propose a similar change to section 77A(10). This subsection says regulations may be made on the handling of data by bodies holding them. As such, it applies not only to bodies with whom the data are shared, but also to handling of the data by the road authorities and by TII. In this case, I propose to change "may" to "shall", so that regulations covering the matters in section 77A(10) will have to be made. This is set out in amendment No. 37. I notice Senator Ruane also proposes a change of "may" to "shall" at this point, via amendment No. 38. I am happy to say we are in agreement. My amendment is slightly different, in that it also incorporates a change to the numbering of section 77A(10), which will become section 77A(12), to take account of earlier changes in the amendments dealt with today. I ask the Senator not to press amendment No. 38 and to agree on amendment No. 37.

Senators Higgins and Ruane also propose to change "may" to "shall" in section 77A(9), via amendment No. 36. I do not agree that changing "may" to "shall" is warranted in this instance. Section 77A(9) allows for the Minister to prescribe suitable and specific measures, including those listed in section 36(1) of the Data Protection Act 2018, to protect the rights and freedom of data subjects. Most of the measures in section 36(1) of the 2018 Act are already listed in section 77A(10). Section 77A(9) offers an option, where needed, to go beyond what is in section 77A(10). Now that I have agreed with Senators Ruane and Higgins that we should make the regulations, which go beyond the requirements of the Data Protection Act by making regulations under section 77A(10) mandatory, section 77A(9) offers an option of going beyond that again, if necessary in particular cases. As such, it makes sense to leave it optional, that is, to leave it as "may" rather than "shall". Therefore, I cannot support amendment No. 36.

I hope it is clear from what I have said that we are considering carefully what was said on Committee Stage. We have agreed that there should be mandatory rather than optional regulation of data handling, over and above the requirement of the Data Protection Act, by proposing to change "may" to "shall" in section 77A(7) and section 77A(10). Going beyond that in section 77A(9) is unnecessary for the reasons I have set out.