Niall Collins (Limerick County, Fianna Fail)

I am pleased to be here with Members of Seanad Éireann today to seek approval of regulations under section 64 of the Data Protection Act 2018 in respect of the Data Protection Commission, Office of the Information Commissioner and the Comptroller and Auditor General. The EU Charter of Fundamental Rights and the GDPR established the protection of personal data as a fundamental right and a core value of the European Union.In Ireland, the Data Protection Act 2018 gives further effect to the GDPR and supports its practical implementation. The draft regulations before us today are being made under section 64 of that Act, which provides for the making of regulations prescribing requirements to be complied with when the rights of data subjects and obligations of data controllers, referred to in section 60 of the Act, are restricted.

There are three separate but identical regulations, save for the references to the relevant body. One may ask why rights or obligations under GDPR would ever be restricted. The right to data protection is not an absolute right. It must always be balanced against other rights and interests. The GDPR recognises that there may be limited circumstances under which an organisation has grounds to refuse to grant an individual’s request to exercise his or her data protection rights. GDPR sets out limited circumstances in which restrictions apply and permits further restrictions in national law, provided that the restrictions respect the essence of fundamental rights and freedoms of individuals and must be necessary and proportionate to safeguard certain objectives of societal or general public interest.

In Ireland, section 60 of the 2018 Act gives further effect to Article 23 of the GDPR and provides for restrictions on the obligations of controllers and the rights of data subjects for important objectives of general public interest. The rights and obligations concerned are those provided for by Articles 12 to 22, inclusive, as well as Article 34 and a part of Article 5 of the GDPR. This includes rights to access the personal data, right of erasure and right to rectification.

While section 60 provides for a suite of public interest matters, including Cabinet confidentiality and parliamentary privilege, these regulations are specifically concerned with section 60(3)(c). Section 60(3)(c) provides that the rights and obligations under Articles 12 to 22, 34 and a part of Article 5 of the GDPR are restricted to the extent that the personal data concerned are kept by the Data Protection Commission, the Office of the Information Commissioner and the Comptroller and Auditor General in the performance of their functions.

Concerns were raised by the European Commission that section 60(3)(c) of the Data Protection Act 2018 could be interpreted as providing a blanket exemption to the Data Protection Commission, the Information Commissioner and the Comptroller and Auditor General by not requiring an assessment of the necessity and proportionality of restricting rights and obligations on a case-by-case basis, as required by GDPR. To address the concerns raised, two sets of regulations were prepared. First, regulations under section 3 of the European Communities Act 1972 were made in November 2024 to amend section 60(3)(c) to clarify that the restrictions applied by the Data Protection Commission, Information Commissioner and Comptroller and Auditor General, as the case may be, must be necessary and proportionate to safeguard the performance of a function of the body concerned.

In addition, the updated section outlined the matters each body must have regard to when determining whether a restriction would be necessary and proportionate. These include the extent to which the exercise of a right or a compliance with an obligation would prejudice the performance of a function of the body or whether the disclosure of the performance of a particular function would be prejudicial to that body. Further, the bodies are required to respect the essence of the right to data protection of a data subject and have regard to the risks to the rights and freedoms of a data subject that may result from such a restriction.

The draft regulations before the House today are procedural in nature and seek to build upon the requirements set out in the regulations made last year. They are the second and final regulations in a suite of regulations to address the Commission’s concerns. Specifically, the regulations require the Data Protection Commission, the Information Commissioner and the Comptroller and Auditor General to ensure that restrictions, which are being applied under section 60(3)(c) for the performance of their functions, are only in place for as long as is necessary and are proportionate to safeguard the relevant function, and that relevant information about the restrictions is provided to the data subject, including the reason, except where disclosure would prejudice the body in the performance of its functions. In addition, each body must prepare and implement policies and procedures detailing data storage, security and access arrangements and must periodically review its policies and procedures.Also, each regulation provides that any communication between the body and a data subject must be in an easily accessible form and be in plain language. The Department has engaged extensively throughout the drafting process with each of the bodies concerned, all of which have expressed satisfaction with the draft regulations.

I confirm that these draft regulations put in place procedural obligations on the Data Protection Commission, the Information Commissioner, and the Comptroller and Auditor General when seeking to restrict the rights or obligations necessary to safeguard the performance of a function of the body concerned. The draft regulations do not introduce any new restrictions nor reduce the rights of data subjects. They are drafted to better align our national provisions with Article 23 of the GDPR and ensure that clear procedures are in place governing the limited circumstances in which rights or obligations are restricted under section 60(3)(c).