Seanad debates
Wednesday, 1 July 2015
Communications Regulation (Postal Services) (Amendment) Bill 2015: Committee and Remaining Stages
10:30 am
Denis O'Donovan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
I welcome the Minister for Communications, Energy and Natural Resources, Deputy Alex White.
Denis O'Donovan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
Amendments Nos. 1 and 12 are related and may be discussed together.
David Cullinane (Sinn Fein)
Link to this: Individually | In context | Oireachtas source
I move amendment No. 1:
As these are simple amendments, I do not propose to delay the Minister. The purpose of the section is to strip data subjects of their data protection rights with regard to the postcode and remove their ability to take action to vindicate these rights. This runs against the spirit of the Bill, which is supposed to protect citizens. For this reason, the amendment proposes to allow a person to sue in the event that his or her personal postcode data are abused.
In page 7, to delete lines 19 to 21 and substitute the following:"(2) A person who breaches the Act of 1988 in relation to postcodes shall be liable in damages in tort.".
Alex White (Dublin South, Labour)
Link to this: Individually | In context | Oireachtas source
Section 66C(2) clarifies section 6A of the Data Protection Acts 1988 to 2003, which is the main legislation dealing with data protection. This legislation relates to the processing of personal data which is likely to cause damage or distress. This is a fundamental principle in the Acts. Section 2 provides that this provision in the Data Protection Acts does not apply where the processing is necessary to undertake a legitimate postcode activity. This would cover, for example, a circumstance in which an owner or occupier of a property disagrees with the matching of his or her address to an Eircode, in particular, the routing key element of the Eircode, despite the accuracy of such matching. Section 66C(2) is, therefore, an essential provision in the Bill.
I remind Senators that section 7 of the Data Protection Act already provides that data controllers and processors owe a duty of care to data subjects. This duty relates to the collection of and dealings with personal data. The provisions of the Data Protection Acts apply in respect of breaches of the rights contained in the Acts. Section 30 of the Data Protection Act 2003 provides that the Data Protection Commissioner may bring summary proceedings for an offence under the Act. Section 31 of the Act provides for penalties for offences under the Act.
It is neither appropriate nor necessary to provide for offences of breaches of data protection rights when such provisions already exist in the Data Protection Acts. In addition, the Bill provides that the Minister can make regulations providing for a power to suspend or terminate a value-added reseller licence, as well as the power to carry out audits. The activities covered by this Bill are only those which are essential to the delivery and maintenance of the postcode system. The Senator is motivated by a concern to ensure that personal data continue to be protected and I share his view that it must be protected. I remind him, however, that users will still be subject to the full rigours of the data protection legislation.
To put this in another way, we are making an exception but one which only covers dealings with the postcode. If there is any linkage of the postcode to a name or some other identifier, all the existing protections under the Data Protection Act will apply. The best way to describe what is being proposed is that while we are making an exception, it will only apply to the use of the code simpliciter. Once the code becomes identifiable with an individual or any other information that would link it to an individual, all the existing protections in the Data Protection Acts will be triggered. It is extremely important to clarify the matter and confirm the position.
On the extra-territorial effect of the legislation, the Data Protection Act applies to all data controllers established in the State. Section 11 of the Data Protection Act provides for restrictions on transfers of personal data outside the State. The transfer of personal data by a data controller to a country or territory outside the European Economic Area may not take place unless that country or territory provides an adequate level of data protection. I emphasise that this is existing law.
Furthermore, under section 11 of the Data Protection Act, the Data Protection Commissioner may prohibit the transfer of personal data from the State to a place outside the State and may serve a prohibition notice on the data controller or data processor. These provisions will continue to apply. Moreover, the Bill provides that the Minister may make regulations requiring a value-added reseller to provide evidence of having registered with the relevant data protection authority, where applicable, before a value-added reseller licence will be granted. This requirement is not limited to registration with the Irish Data Protection Commissioner.
For these reasons, it is not my intention to accept the proposed amendments.What is concerning the Senator is that there is an exception being made here but that exception is very narrow. It only deals with the treatment of the actual code. I will not say a code on its own is meaningless because it is the postcode for the house but once there is anything that links it to the Senator, me or any other citizen, the existing protections kick in.
Denis O'Donovan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
Is the amendment being pressed?
Denis O'Donovan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
Amendments Nos. 2 to 6, inclusive, and 8 to 10, inclusive, are cognate and may be discussed together. Is that agreed? Agreed.
David Cullinane (Sinn Fein)
Link to this: Individually | In context | Oireachtas source
I move amendment No. 2:
We believe the Data Protection Commissioner is the appropriate officer to carry out the work of upholding data protection. Capita, the postcode contractor, is not sufficiently distant from its customers and suppliers who are the most likely offenders and, therefore, we believe it is necessary to change who is responsible. These are simple amendments essentially to change "postcode contractor" to "Data Protection Commissioner", which in our view will give more oversight.
In page 7, line 23, to delete “postcode contractor” and substitute “Data Protection Commissioner”.
Alex White (Dublin South, Labour)
Link to this: Individually | In context | Oireachtas source
We are taking amendments Nos. 2 to 6, inclusive, and 8 to 10, inclusive, together. The complaints procedure set out in this Bill refers to the process that owners or occupiers of property can follow in regard to a postcode related complaint. The complaints procedure is set out in the postcode contractor's code of practice. I emphasise that the postcode contractor has consulted with the Office of the Data Protection Commissioner in the drafting of the code of practice.
I want to clarify and confirm to the House that the Office of the Data Protection Commissioner has made a number of observations and recommendations which the postcode contractor will accept. The Office of the Data Protection Commissioner has stated that once these changes have been incorporated into the code of practice, the Data Protection Commissioner will approve the code of practice. There is an important input from the Data Protection Commissioner.
Furthermore, the Data Protection Act already provides powers for the Data Protection Commissioner to investigate complaints and to enforce compliance with the Act, as I indicated earlier. These provisions apply to any postcode related complaints which the commissioner may receive. There is nothing to prevent persons complaining to the Data Protection Commissioner where there is a perceived breach of the Data Protection Act in the context of this postcodes project. It could be said that it is not necessary to put in a reference to the Data Protection Commissioner because a person could in any event make a complaint to the Data Protection Commissioner under the Data Protection Acts, and those provisions are already part of our law.
I respectfully say to the Senator and to the House that it is neither necessary nor appropriate to set out investigative functions for the Data Protection Commissioner in this Bill given that there is a statutory regime already in place. As I said, the Office of the Data Protection Commissioner has been consulted extensively during the drafting stages of the Bill and has at no stage indicated that the provisions set out in the 1998 Act are inadequate. I trust that the Senators will accept that for those reasons, I am regrettably unable to accept these amendments.
Denis O'Donovan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
Is the amendment being pressed?
Mark Daly (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
I move amendment No. 7:
This is an issue relating to the wording "as soon as may be after it is made". My concern is that the other issues in the Department take over. The Minister said it is already in place but I believe that deadlines are important because one knows whether one meets the deadline. However, down the line we might wonder whether a particular regulation was ever put in place only to find that because there was no deadline, there was no real need to do it. I suggest that "as soon as may be after it is made" is a loose term.
In page 7, line 37, after “decision” to insert “within 90 days”.
Alex White (Dublin South, Labour)
Link to this: Individually | In context | Oireachtas source
I thank the Senator. Section 66D of the Communications Regulation (Postal Services)(Amendment) Bill sets out an obligation on the postcode contractor to draw up procedures for dealing with complaints by owners or occupiers of property relating to the use of postcodes by the contractor or by a value added reseller. As is the general rule on primary legislation, this section of the Bill contains the general principles and policy governing the complaints process and, pursuant to section 66D(7), the Minister is given a regulation making power to set out the details of the complaints process. I confirm for the House that the regulations will make provision for the procedure to be followed in investigating complaints, the requirements to be complied with by complainants, the remedies and redress available to complainants, and any other matter considered necessary or appropriate to secure the effective protection of complainants. Furthermore, pursuant to section 66D(1), the postcode contractor will set out a detailed complaints process in its code of practice, and that code is referred to in section 66E. I repeat that the postcode contractor has consulted with the Office of the Data Protection Commissioner in the drafting of the code of practice.
The Senator raises a fair question, which I have considered. The idea of a time limit can be provided for but I respectfully suggest to Senator Daly that the proper and appropriate instrument in which to include a time limit would be in the regulations that will be enacted pursuant to section 66D(7) and the postcode contractor's code of practice. I do not believe it is necessary or even appropriate to amend the primary legislation but I am prepared to agree, having considered the issue the Senator has raised, and it is a fair issue, to include a time limit in the relevant regulations in response to the point he makes. I can confirm that the time limit will also be provided, if the Senator can accept my good faith in this regard, in the complaints procedures to be included in the postcode contractor's code of practice. On that basis, the Senator might be agreeable not to pursue an amendment to the primary legislation but to rely on my good faith and intention to do as he wishes us to do but to do that by way of regulations.
Mark Daly (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
I thank the Minister for the reply. We will not press the amendment.
Denis O'Donovan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
Amendment No. 11 is in the name of Senators Daly and Wilson.
Mark Daly (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
I move amendment No. 11:
I know I will be relying on the Minister's word on this one. We are all conscious of the words "may" and "shall" inserted in Bills. The Bill refers to the requirement on the Department regarding the procedure to be followed in investigating complaints, the requirements to be complied with by complainants and so on. I know the Minister is doing it but the reason behind the primary legislation is that the onus is on the Department that it must do it. We have been given assurances that it is in the process of doing it but, as often happens, between the primary legislation and the regulations, sometimes it does not happen. The word "may" is inserted to allow for the opt-out in that if it does not happen, no one is breaching anything. I know the Minister is doing it and that it is all in train, but the reason behind the primary legislation is to keep the word "may" out of something. The word "shall" is far more important and powerful. I ask the Minister to consider inserting the word "shall" in the Bill. This is the reason for some of the concerns about the Bill and the reason the Data Protection Commissioner asked for this primary legislation in regard to remedies and redress available to complainants. It must be done. This is the core issue behind the legislation but we are saying in the primary legislation, that we might do what the commissioner said. The primary legislation is about ensuring that all the regulations will, not may, meet the requirements of the Data Protection Commissioner.
In page 8, line 5, to delete “may” and substitute “shall”.
Alex White (Dublin South, Labour)
Link to this: Individually | In context | Oireachtas source
Although the regulation-making power in the proposed section is expressed as "may" and it is not framed as a mandatory obligation on the Minister, it remains the case that the regulations permitted under the section form part of the overall scheme of the Bill. The Data Protection Commissioner has been enormously helpful and supportive of this entire process, but the decision to bring forward this legislation was my decision. It was the Government's decision on my recommendation. I do not want anybody to think we are in some sense being directed to bring forward legislation. Although the Data Protection Commissioner has been extremely helpful and supportive it is my call and I take absolute responsibility for having this legislation drafted and bringing it before both Houses.
I am tempted to tell the Senator I shall certainly bring forward the regulations. The Department is drafting them. It is part of the scheme of what we intend to do. Substituting the word "may" with "shall" would not make any constructive difference to the process as it stands. When I was a Member of this House we had debates on other legislation as to "may" and "shall". The view taken generally about the use of the word "may" is it is in legislation to enable a Minister to do something. It is not mandatory that a Minister do it but it is there to say it is part of the scheme of what it is intended to do. One puts into primary legislation the basis on which it would be done, in other words an enabling provision for the Minister to do it. It will be done and it shall be done. It is not necessary to put it in the legislation. Regrettably, in the circumstances I will not accept the amendment, but I take very much the thrust of what the Senator has said and assure him of my bona fides in this regard.
Mark Daly (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
It is a drafting issue. The intention is "shall" and "may" allows for cover for the Department if it is not done. If no regulations are put in place anybody in the press can say the Department is not obliged to do it, which it is not under the legislation.
Our job here is not about the Minister or the officials but the process. According to the process if a Department under legislation shall do something then it must be done. There are consequences. I take into account that regulations form part of all legislation and they are very important because we cannot deal with minute detail in the primary legislation. Perhaps the Minister will examine it once more and explain to the other House that this is the kernel of the issue. What I look for in something like this is that the Department must do it. Delays can happen. A question might be sent to the Attorney General before the summer but then another piece of legislation might come before the Department to which the Minister's energy and that of everybody else would be turned. This is the difference. Of all the lines in the legislation, and I thank the Minister for bringing it forward, this is the one with which we have an issue. This is the kernel of it. We will not press it to a vote but it is about requiring the Department to ensure if, God forbid, the Minister was not in office in five months time because he was promoted to Tánaiste and leader of the party at least his successor, the Department and the system would be required to ensure the regulations which the Minister wants in place shall be put in place.