Tuesday, 3 July 2018
Data Sharing and Governance Bill 2018: Committee Stage (Resumed)
I move amendment No. 21:
In page 34, line 24, to delete “20 and 21” and substitute “20, 21 and 34”.
This amendment relates to section 34 on the establishment of a personal data access portal. The section details what should be included on the website for data subjects to access their rights, including sending a request to a public body in respect of exercising the rights provided for in Articles 15, 16, 17, 18, 20 and 21 of the GDPR. These are: the right of access by the data subject; the right of rectification; the right to erasure; the right to be forgotten; the right to restriction of processing; the right to data probability; and the right to object. Article 19 inserts a notification obligation regarding rectification or erasure of personal date or restriction of processing. Article 34 inserts a communication of a personal data breach to the data subject.
I thank Senator Ruane for moving the amendments. We had a good discussion the last day and it is regrettable that Senator Higgins is not here. I have good news for Senator Ruane. In principle, in respect of amendments Nos. 20, 21 and 22, with some technical changes to the wording, we are agreeable in principle to what the Senator has outlined. I will take these away and consider them in tandem with the Office of the Attorney General between now and Report Stage.
In amendment No. 22a, the Senator is proposing to insert a reference to the necessity and proportionality of the data sharing required to provide the information that data subjects may request from the portal. The proposed amendment follows on from similar wording the Senator has proposed in amendments Nos. 13 and 16. The purpose of the data portal is to make it easier for citizens to exercise their rights under Articles 15 to 21, inclusive, of the GDPR. These articles give strong rights to the data subject to access his or her data, to have it rectified or erased if appropriate and to restrict or object to the processing of the data.
As worded, the amendment proposed would appear to have the effect of requiring public bodies to apply a necessity and proportionality test in deciding whether to provide information the data subject has sought through the portal. This would be incompatible with the GDPR and I am sure that was not the intention. Accordingly, I cannot accept the amendment and I ask the Senator to consider withdrawing it and rewording it. However, having reflected on this and other points the Senator has made in respect of amendments Nos. 13 and 16 last week, as well as this amendment, I think the Senator's concerns can be addressed by adding a requirement for public bodies to make a formal undertaking to abide by the principles of data protection as set out in Article 5 of the GDPR. This could be added to the list of requirements for the data sharing agreement in section 18 and I propose to make an amendment to that effect on Report Stage.
I move amendment No. 22:
In page 34, line 25, to delete “Regulation.” and substitute the following:
“Regulation, and(c) view information about any data breaches where their personal data may have been affected and information on how to request further information.”.
I thank the Minister of State for addressing those issues and for indicating that he is willing to look at the issues on Report Stage. In that context, I will not be pressing these amendments. I note, in particular, the Minister of State's concern that the necessity and proportionality should sit with the organisation rather than with the test of the individual's request. I am happy to look at any amendment that he might wish to put forward. One amendment I will potentially return to on Report Stage is amendment No. 21 in respect of including the direct reference because a number of articles of the GDPR are referenced there, as well as Article 34 of the GDPR around-----
I refer to amendments Nos. 22 and 22a. On necessity and proportionality, I think that these have been addressed. I will return to them and I hope that the Minister of State will return to them as well on Report Stage. I take necessary and proportionate on board but it may need to be reworded. In that context, I will not press the amendments.
I move amendment No. 22a:
In page 34, line 36, to delete “information” where it firstly occurs and substitute “only such information as is necessary and proportionate”.
This is the key issue of necessity and proportionality. I have one question for the Minister of State. He had indicated he was willing to reflect that more and it was an issue that came up in other parts of the Bill. Am I right in saying that he is open to having that kind of term reflected in an appropriate way in different parts of the Bill? I apologise if I am making him repeat himself.
I move amendment No. 22b:
In page 36, between lines 13 and 14, to insert the following:“(2) Of the members of the Board, an equal number shall be male and female.”.
I am speaking to amendments Nos. 22b to 24a, inclusive. Amendment 22b and amendment 24a both relate to the data governance board. This a major concern I have with this Bill. We have heard at length that there is a new process being proposed.That is a process which is an alternative to section 38 of the Data Protection Bill which was agreed and passed by these Houses. The parallel process, and I accept there may need to be a new process, has as one of its key linchpins and proposals from Government a data governance board which will have oversight and decision-making in relation to what the Minister of State at the Department of Finance, Deputy O'Donovan, described in our last discussion as thousands of data sharing agreements. It is a very significant concern to me. I will speak more on this because supplementary amendments will touch on the same points and I will not repeat them. It is a very serious concern that at the moment the constitution of the data governance board does not provide lengthy detail or clarification around the membership process. We are simply told this data governance board, with its immense power and role, shall consist of not fewer than six and not more than 12 members, who shall be appointed by the Minister and that the Minister shall ensure they have the necessary knowledge, experience and competence. This is an extraordinary free hand for a Minister. Given the lengthy debates we are having, and will have, over the next few days around the judicial appointments process, for example, given the concerns we have had around the IHREC board and given that many here have spoken passionately today about the need for rigorous governance, real clarity and transparency, it is simply not acceptable that we would have a board appointed by the Minister which could end up being six to 12 heads of public bodies who would then sit and judge for themselves as to whether they should be given permission to share data. We are effectively talking about self-regulation for public bodies, potentially. For that reason, I will put forward a number of amendments and, as I said, I will not speak at length to each of them because they are grouped here. To make a general point, there are a number of amendments to try to put forward proposals for what a data governance board might look like. I am very conscious that when a very similar Bill was being debated in 2013-2014, Daragh O Brien and other data protection experts put forward proposals for what a data governance board might look like, but this is very different from that.
On the two amendments we are speaking to now, one is a proposal that the membership of the board should be male and female in equal numbers, which is in line with both the Irish Human Rights and Equality Commission, IHREC, board and the judicial appointments board which is being debated by these Houses. That is in excess, however, of what is currently required under legislation which is that 40% of the board should be of each gender. Will the Minister accept that amendment and, if not, will he put forward proposals? We know gender balance on boards is a crucial issue.
The other issue is the terms. It says that "[t]he Minister shall determine the terms and conditions of appointment, including the term of office". There is no clarity for us and, as the Legislature, we are being asked to sign off on such a significant new national infrastructure on data sharing, we need clarity around the board's function. I suggested in amendment No. 24a that the Minister may set clear periods of three years for appointment to a term, and reappointment for a maximum of two other three-year terms. I am very open to the Minister's proposals on this. This is me suggesting terms of office but I am happy to hear what he would suggest. We need to put some clarity around the terms of office of these officeholders would be in the Bill. The Minister's proposals are as welcome as mine and, if he brings forward proposals, I will not press mine.
Is amendment No. 23 covered by that, also?
The crucial issues are amendments Nos. 23 and 24. Amendment No. 23 suggests that membership of the board should be advertised through the Public Appointments Service, PAS. It is standard and good practice to know there is an independent body adjudicating as to who is qualified and appropriate to sit on this board. Members should be appointed by the Minister on the recommendation of PAS, and with the agreement of the Government. It is important to recognise this board will cut across every single Government Department. It will have oversight on data sharing under every Department and its partners, as well as every company the Departments work with. It is very important that not only is the Minister for Public Expenditure and Reform, who has full responsibility, satisfied, but that all Ministers are satisfied with the representation that is there, and that there is accountability at Cabinet level.
There is a real danger of public service capture of this board so, in my final amendment in this section and on this theme, amendment No. 24, I propose no more than half of the board should be employees of a Department or a public body. This is to ensure we do not have full self-regulation but that there are genuinely independent members of the board. At least two members of the board should have an expertise in the area of data protection, and there are other expertises that will be needed also, but data protection is crucial. Finally, at least one member should be both an independent non-employee of the Department or public body and have expertise in the area of data protection. This ensures there will be at least one independent data protection expert who is not beholden to, or employed by, those they are going to adjudicate upon.
These are my proposals. This is me setting out some ideas of what a transparent data governance board might look like. If the Minister has proposals he would like to bring forward, I am very happy and open to hearing them. If not, I will certainly press these amendments on Report Stage, if not today.
I would like to thank Senator Higgins for tabling these amendments, and to say I am fully supportive of them. It is vitally important that this board, which pans so many Departments, has a constitution that sets best practice, in terms of gender balance, duration and everything else. It is crucially important we get this right. This board needs to lead the way in many things. There are expectations on voluntary organisations around the constitutions they set up and how they are run, but we have to get the governance right here, particularly for this one. I am fully supportive of all those amendments.
The amendments relate to gender balance, membership of the board and tenure. Senator Higgins proposes a set of amendments to section 47 which concerns the membership of the data governance board. The section provides for the appointment of members and the chairperson by the Minister, and the terms and conditions of appointments of the board members. Amendment No. 22b proposes an equal number of male and female members be appointed to the board. In practical terms, I cannot accept this amendment as worded because it would make it impossible to have an uneven number of members on the board, and I think people will accept that. However, I fully appreciate and support the principle of gender balance that the Senator is promoting here. It is a matter of Government policy that there be at least 40% representation of each gender on State boards and all boards, including the data governance board. As the parent Department, the Department of Public Expenditure and Reform is in compliance with that, and this matter was addressed this afternoon in the Dáil. The data governance board must comply with that requirement. Accordingly, while I do not see an amendment in this regard as essential, since it is already Government policy, I am willing to make provision to reaffirm the 40% target for gender representation on the board. I will make that proposal on Report Stage.
Amendments Nos. 23 and 24 concern the criteria for appointing members to the data governance board. As is clear from section 47 (6) of the Bill, which permits appointment of ex officioand external members, it is my intention that the board will have a mixture of both. The guidelines on appointments to State boards already set out the role of the PAS in selecting external members of boards, and these will apply to the data governance board. Ex officio appointments are not normally made via the PAS process, and I see no need to provide for it here.I do not propose to accept amendment No. 23 primarily because the ex officio members will be, by and large, public servants, some of whom will be public servants from my Department who may have been involved in the drafting of this Bill. To require those who are in place as a support in terms of their ex officionon-voting role on a board to apply for membership would be contradictory, bearing in mind the design and purpose of the Bill, and I do not believe that was the intent of the amendment.
On amendment No. 24 regarding the balance of external and ex officiomembers of the board and the skills that the members should have, it is my view that to allow for the greatest flexibility we should not be specific at this time in terms of the composition of the board and its expertise. It makes sense to work out the job specifications and specialist expertise required in consultation with the chairperson following enactment of the Bill. It also makes sense to wait and see how the board is operating in practice before making any changes that may be required. Accordingly, I do not believe this amendment is necessary at this time. However, it may be that there is need for greater transparency vis-à-vismy intentions in this respect and I will reflect further on the matter between now and Report Stage, particularly in the context of what Senator Higgins had to say in her contribution.
Amendment No. 24a proposes the time limits to be set in terms of the office of board members. While this is a reasonable proposal in respect of external members, it could be restrictive were it to apply to ex officiomembers. To reiterate a point I made earlier, we could end up with the people who we want on the board, the non-ex officiomembers, being kicked off the board. I do not think this would be in anybody's interests, and nor do I believe it was the intention of what is proposed. Many ex officiomembers will hold a position on the board by virtue of their skills and expertise, their place within the public service and their position within the organisation. Accordingly, I believe that more flexibility is needed in respect of the term of office for ex officiomembers. Nevertheless, I note the Senator's point and I will reflect further on the matter between now and Report Stage, particularly in respect of the non-ex officiomembers.
I take the Minister's point that it may not be possible to advertise all the ex officiomember positions through the Public Appointments Service but it would be important that there is clarity around what proportion of the appointments will be external and advertised through the Public Appointments Service. Also, if the Public Appointments Service is to provide board members it should not provide only generic board members and it will need to be given a brief in that regard. I would like some sense of the guiding criteria in that regard, as is available in the case of many other boards and bodies. A key point will be the ratio between ex officio, internal and external appointees and their level of independence within the board.
Another key issue is the guidance on the minimum skill requirements, worded in a way that it allows for further criteria or skills to be added because we need to allow for flexibility as particular skills are recognised as necessary. We know that we will need people on this board who have data protection expertise and that there are other boards that will require technological expertise. I am sure the criteria can be worded in a way that assures the Legislature that the expertise is available in making these important decisions.
Amendment No. 23 states: "Members shall be appointed by the Minister on the recommendation of the Public Appointments Service and with the agreement of the Government.". I would welcome further comment from the Minister of State on what is proposed in this amendment.
On the final question and the procedures in place for the appointment of people to State boards, I have no difficulty bringing forth a Report Stage amendment to the effect that the Minister shall have regard to the existing guidelines and so on.
It is important that the board is allowed to do its job into the future. If the board deems that there is a skills or expertise deficit within the board it can make a recommendation to the Minister for appointment. It would be counterproductive and overly prescriptive to require the board to do X, Y and Z from the outset. Once the board is constituted and operational it may identify a skills deficit outside of which we in this House and the other House will have deemed appropriate. If may take time for any skills deficit to be identified. I do not want to restrict the board from being able to make a recommendation to the Minister in the future regarding the appointment of a particular person to fill a particular role.
As I said in my initial contribution, the Department of Public Expenditure and Reform is the parent Department for the legislation concerning State boards and appointments thereto, particularly in regard to gender balance and the Public Appointments Service. There is other legislation in the offing in regard to the relationship between Departments and the public sector and so on. We would have no reason to not reflect positively on what Senator Higgins said but I do not want to do something that will unnecessarily tie up a board in the future. I will look at the ratio in terms of internal, external and ex officiomembership, with a view to, if possible following reflection with the Attorney General, setting a maximum and minimum in that regard. I am open to considering if it would be possible to constitute the provision in such a way as to ensure a balance in favour of one rather than another. If I can, I will bring forward amendments to that effect on Report Stage.
I thank the Minister of State for his willingness to engage on the Bill. I look forward to further engagement on it with him between now and Report Stage. On the issue of a maximum and minimum balance, I believe a balance of more external members and independent members will be crucial to this board having credibility. On the issue of job specifications, I do not think the criteria needs to be overly prescriptive. There will be particular expertise and skills required for this board. As we know, without the necessary expertise in a room, it is often not possible to identify any lack of expertise. I am not suggesting that clear criteria be set out for each of the six to 12 members. I recognise that the membership of the board is set at between six and 12 people in order to provide flexibility to bring in skills as required. I believe there are core skills that will be required on this board and we need to ensure that at least one of the six, ten or 12 members has those skills. We can discuss that further on Report Stage.
I move amendment No. 24b:
In page 36, after line 37, to insert the following:
"(5) Each committee, not later than 30 June in each year, shall prepare and submit to the Board, a report on its membership and the performance by it of its functions in the immediately preceding year, or in the case of the period from the date the Board is first appointed to the next following 30 June, that period. Such reports shall be available to the Minister and Oireachtas committees on request.".
Amendments Nos. 24b, 24c and 24d all relate to one of the more concerning aspects of the proposed governance structure. Again I hope that, as the Minister of State has indicated his willingness to examine how we can make the data governance board more transparent, he may also view this constructively. The concern here is that the data governance board, with its six to 12 members appointed by the Minister, may also establish subcommittees. These subcommittees seem to have almost no rules around their operation, excepting that they must include one board member. I appreciate and recognise that the Minister of State is proposing to reassure us on this matter on Report Stage but we are looking at a very concerning scenario in which we could have a board made up of a number of members from public bodies or other ex officio members which could establish committees. That has the potential to be highly non-transparent. These are committees whose membership does not necessarily pass through the Public Appointments Service or even through any formal appointment process. These are simply committees made up of any people, with one board member present. One could have a committee of ten, five or 20 members including one board member.
There is a lack of clarity around the committees and their role. Having served on boards myself, I am aware that situations arise in which a large amount of power is effectively delegated to a subcommittee. I recognise that the subcommittees can only give advice and make recommendations to the main board but we have all seen situations in which a subcommittee of a board effectively puts things to that board for rubber-stamping. It is really important that these subcommittees are transparent if they are to have a key advisory role in respect of these important decisions being made in respect of our law, our practices and the practices of different bodies in respect of data sharing and the thousands of data sharing agreements that might be signed.
These are reasonable amendments. I have not proposed to do away with the committees despite the negative things I am saying about them. I recognise they may have a role but I have suggested that each committee should prepare and submit to the board an annual report on its performance of its functions and on its members to ensure transparency around its membership. I have also suggested that each subcommittee that might be established with these non-elected and non-nominated members should expire after two years, excepting if its membership and mandate in formally renewed by the board, to ensure we do not have a situation of embedded power. I am just trying to make sure that there is an accountable decision in the minutes of the data governance board at least every two years which says whether it wants to continue with a given subcommittee in order that we do not have subcommittees made up of individuals who have neither been selected by the Minister nor by the Public Appointments Service and who may be in place for five or ten years at a time. It is really important that we have regular check-ins to ensure accountability in that regard.
Again, these are very reasonable amendments. They literally just require an annual report from the committees and a renewal of mandate every two years. In line with this, amendment No. 24d is really a technical amendment which ensures that the report which the data governance board will send to the Minister would include information on the activities of its committees and subcommittees. Again, I hope the Minister of State might be able to accept these amendments.
These amendments relate to the composition of committees. I do not have any difficulty with the general thrust of what the Senator is saying. The reason we left section 48 as it was when drafting the Bill was that we did not want to be overly prescriptive. However, there is no difficulty whatsoever in reflecting on the concept of the annual reports, having regard to advice we will receive from the Attorney General, and having a run-down in respect of the activities and membership of subcommittees as part of the annual report of the organisation. I do not see that as an issue. We will certainly reflect on it. If I can, I will bring forward an amendment of that nature on Report Stage.
On the type of committees, I know where the Senator is coming from in respect of amendment No. 24b. However, I would be a bit wary of it as we do not want to be overly prescriptive because there may be situations where an ad hoccommittee might have to be established within the organisation for a brief period and for a fixed role that might not necessarily have anything to do with the actual carrying out of a role that would be in contravention of any aspect of the Bill. However, the membership, activities, and number and durations of meetings can be incorporated into the report as far as I can see. I do not see a difficulty at the moment in respect of the annual report.
I will reflect on term limits. I have an open mind on the issue. Given the changes we have already made in the Department of Public Expenditure and Reform with regard to the Public Appointments Service and other reforms we have made, many of these proposals seem reasonable. We could take the opportunity between now and Report Stage to consider those committees that could be required for a shorter period of time than that being defined by the Senator. Suppose there is a committee that is sitting for a very short period for a specific purpose and whose job is done. It obviously will be a requirement of the board to constantly reflect on and review the work of the subcommittees established under its jurisdiction and to report as such. I have stated my intention to review it. Having had the opportunity for my officials to discuss the matter with the Attorney General, I do not see a difficulty per sewith most of what the Senator is saying.
I thank the Minister of State very much. He makes a valid point as there are of course short-term ad hoccommittees. In that regard, I would be very happy if he wanted to simply set a maximum term and to allow for more flexibility. That maximum terms could be two or three years or whatever is deemed to be most useful or appropriate. That is absolutely fair enough. In that context, I will not press the amendments at this point. I have already moved amendment No. 24b. I will withdraw it and reserve the right to come back on Report Stage.
I have an issue with respect to amendment No. 24c. I do not want to have a situation where somebody who is on the board or a subcommittee for a specific purpose by virtue of his or her expertise, whether they are an ex officiomember of a lay member, is unnecessarily kicked off of it. If we are overly prescriptive on the duration of the committee that might occur. I know that is not what is intended. There may have to be flexibility there as well. As part of tonight's discussions, I ask the Senator to withdraw the amendment. I will certainly reflect on it between now and Report Stage. I understand the thrust of what she is trying to do with regard to transparency, term limits and reports. I do not have a difficulty with them but neither do I want to discommode the board in the future.
In that context I am happy to accept the Minister of State's expression of willingness to look at this issue again.
Am I to understand that there is no objection to the principle of amendment No. 24d, but rather that the Minister of State intends to move a similar amendment on Report Stage?
I support amendment No. 24d in principle. I will try to bring forward a Report Stage amendment myself with the support of the Office of the Attorney General. I will try to incorporate the thrust and spirit of what the Senator is proposing.
On section 49, can I ask the Minister of State what is the objection to members of local authorities being members of the board? In most cases where legislation is being brought forward which puts boards in place, we see Members of the Oireachtas being automatically disqualified.In most cases, as we know, so are members of local authorities. There is great experience in local authorities. The members are highly educated and come from all backgrounds. We have experts in local authorities and I wonder why there is an objection in this case to members of local authorities. Why are members of local authorities disqualified from serving on the board? Some members of local authorities would be highly qualified for a board of this type and I would prefer if it were removed from the Bill and that the Minister look at it for Report Stage. It disqualifies a cohort of people who stand for public life. They are automatically disqualified from being members of boards.
I agree with Senator Paddy Burke, who is a long-serving member of the House. I was a member of the local authority for 12 and a half years, which is a long time. I will wait for the Minister of State because he is having a discussion with his officials. I do not think Senator Paddy Burke is saying that local authority members should automatically be members of the board, but we should not exclude all 949 local authority members purely because they are members of local authorities. They have skills, talents and an ability to get themselves elected. They have many other skills in many professions and some of these could be incredibly relevant. They could be computer programmers, accountants, solicitors or people in various walks of life. It is common practice now in legislation that local authority members are thrown in as not suitable to serve on boards. As soon as they lose their seats, they might be appointed but this will not happen while they are members of local authorities. It would be more appropriate if this were removed. If people are suitable, they are suitable and if they are not, they are not. However, they should not be excluded just because they are members of local authorities.
I support this. I do not think a cohort of people can be excluded, certainly not local authority members who, as has been the case in recent years in particular, come from a variety of backgrounds. There was a time Mayo County Council when more than 50% of the members of Mayo County Council were auctioneers, but that is a number of years ago now.
For the one or two councillors watching proceedings, their virtues are being extolled in the Upper House. It is ordinarily the case that they are excluded from appointment to any board prescribed in legislation for the same reasons as the rest of us are excluded. They are democratically-elected officials who have a mandate, the same as those covered by section 49(a) and (b), namely, Members appointed to Seanad Éireann and those elected to either House of the Oireachtas or the European Parliament. We could extend the very same rationale to Members of the Oireachtas and the European Parliament as have been extended to members of local authorities. I served as a member of a local authority and held down a job at the same time. There are people in the House who would make brilliant members of the governance board, there are members of the Lower House who would make brilliant members and there are members of the European Parliament who would make fine members. However, can Senators imagine trying to get public buy-in regarding the fact that we will have a data-sharing and governance board which will supposedly supervise the agreements put in place between public bodies and which will be stuffed with politicians? People would be erecting a gallows outside on the plinth for me. The Senator will understand that, reluctantly, I cannot accept the amendment.
As a former councillor, I appreciate that suggestion from a long-serving member of the Seanad from County Mayo who has great knowledge of local authority members, particularly those in County Limerick.
Absolutely. That is a very good point. Given their role, there is no reason local authority officials would not be able to be members. They may very well be ex officiomembers because some of them may have a data role within their local authorities. For example, as is their role as constituted under the managers' orders in local authorities throughout the country, they may be responsible for freedom of information or the handling information. They do not have a mandate, they do not stand for election and it is not regarded as a conflict of interest. I do not think anybody would have a difficulty with that.
Councillors exercise their role in many functions and when a conflict arises, it is up to them to declare it. That is required of them. No one else can accuse them of it, they have to declare whether they have a conflict of interests. Many of us know many people for many reasons. When we have conflicts of interests, we declare them and absent ourselves from the Chamber. This is done in local authorities and elsewhere as well. Just because people are elected a part-time positions and paid €16,000 a year - and some level of expenses to compensate them for all of the costs involved - they are excluded. However, when their lose their seats, everything is suddenly fine. I am not saying that they should be included automatically, nor that we should stuff boards full of them. Many boards do not have this requirement but it has become a tendency in the past five or ten years to start putting this in as an automatic exclusion. It is not fair to equate people serving in €16,000-a-year part-time positions with Members of the Oireachtas. That is not a fair comparison.
I will conclude on this because I have digressed from the amendment. Senator Horkan has made a very interesting point. He will be very glad to know that I will be bringing a Bill on public sector standards before the House, hopefully in the near future. It is winging its way through committee and is nearly finished. It is for the very purpose we are discussing, of which we were reminded again on Thursday night last during an "RTÉ Investigates" programme. It is for this very reason that we want to do this. This is an honourable profession, whether at European, national or local level. The Senator is quite right: the declaration of interest is very important in the context of the public sector. I will bring through legislation to this effect shortly and I am delighted to hear the Senator will be supportive of it.
It is useful that declarations of interest have been raised. Of course, such declarations are implied in the State guidelines but perhaps they might be more robustly reflected. As Senator Conway Walsh stated, county managers can also have concerns and conflicts of interest, particularly where a large number of private bodies will, in effect, be included as public bodies under the Bill and where decisions made may be of great significance to them. As has been indicated, it may be that local authority members may be data controllers so there may need to be a clear protocol to ensure, for example, that if a data-sharing agreement is being decided between two public bodies and if their CEOs or leaders are on the board, then maybe they should not be making the decision relating to that agreement. This is an area we can examine further.
I move amendment No. 25:
In page 39, line 29, to delete “notice.” and substitute the following:“notice, and(v) a deadline for submissions not sooner than two weeks from the date of publication of the notice.”.
This section relates to the public consultation on a data-sharing agreement, the publication of a proposed agreement and an opportunity to engage in it. My amendment proposes that the public consultation must set a deadline that is not sooner than two weeks from the date of publication of the notice. If a data-sharing agreement is being put forward, it is the bare minimum that will effectively allow the transfer of individuals' data between organisations and bodies. They would have two weeks in which to lodge or express any concerns and become aware of that data-sharing agreement.
This relates to an earlier debate we had on Committee Stage to which we will return on Report Stage. I have had some constructive engagement with departmental officials on other measures which could be put in place to ensure that the data-sharing agreement itself, which people are looking at during this period of public consultation, contains useful, usable information and clarity for the people looking at it. Under the GDPR, there is a responsibility to ensure clarity of information and accessibility of information. I appreciate the engagement I had with officials on that and I will return to the usability of data-sharing agreements for public consultation as well as this question of ensuring a suitable time period for consultation.
Section 55 provides that all public bodies shall hold a public consultation in advance of entering into a data-sharing agreement. Section 55(1) provides that the public bodies shall publish: a copy of the draft data-sharing agreement; a summary of the findings of any data impact assessment; and a statement from the data protection officer of each of the public bodies concerned.
The Senator’s amendment proposes that at least two weeks would be given for the making of such submissions. This is a reasonable timeframe and I would accept it. However, section 62 provides that the data-governance board shall specify the time period for consultation. Accordingly, while I accept the principle of the amendment, I propose that an amendment be made to section 62 on Report Stage to give effect to what the Senator seeks and I ask her to withdraw the amendment to section 55.
Section 62 states:
The Board shall specify—(a) the time periods referred to in section 55(1)(d)(iii) and section 56, and
(b) the information to be submitted in accordance with section 56(1)(d).
Section 69 deals with the prohibition on requests for certain documents. We had an earlier Committee Stage discussion on information such as special categories of personal data and so forth. I am reserving the right to see if those special categories of personal data relate to some of these documents.
This section deals with data sharing but also relates back to the question of the data portal. In a number of cases individuals are seeking data and the Minister is informed. I should have stated this when we discussed the data portals because I may return to it on Report Stage. There is a lack of clarity on the Minister being informed when an individual is seeking information through the data portal. It is not clear if the Minister is informed that somebody is seeking data or if the Minister gets to share the information the individual is seeking. Clarity is needed there.
Similar clarity might be needed on the provision of information on data sharing. Again it is information on the fact that data is being shared versus the sharing of the data itself. We need more clarity in respect of the data portal and section 71. I am not pressing anything at the moment on it. I would appreciate the opportunity to engage before Report Stage.
Believe it or not, I may wish to come back on the Schedule because it defines the bodies that cannot be defined as a public body. Earlier on Committee Stage we had some debate on the definition of "public body".
With your indulgence, a Leas-Chathaoirligh, I wish to give notice of Report Stage amendments I intend to introduce. I have referred to some of these in the discussion this evening. I have also taken time to reflect on some of the issues raised during last week’s Committee Stage debate and on Second Stage.
On foot of the discussion about the application of the Bill to special category data, I intend to propose an amendment to Part 2 that will make it explicit that the Bill does not permit sharing of special category data, except for Parts 5 and 8. There may be consequential technical amendments to other sections of the Bill arising from this. The Office of the Attorney General will examine this and advise accordingly during drafting.
I will revisit the definition of a "public body" under section 9 to see if it can be better aligned with the Data Protection Act. However, on initial re-examination it is not easy to see what can be changed and I cannot guarantee that I will be proposing an amendment here.
I will amend section 12(2)(a)(ii)(III) to provide that sharing for the purpose of avoiding a financial and administrative burden shall only be where this is to the benefit of the person receiving the service and not the public body providing the service. Again, there may be consequential amendments in other sections that refer to this purpose. The Attorney General will advise on this during the drafting process.
I will propose a number of amendments to section 18, which sets out the content of the data-sharing agreements. In conjunction with the Attorney General, I will see if it is feasible to provide that the parties to an agreement shall specify the basis on which data is to be processed in a manner along the lines Senator Higgins proposed under amendment No. 14.I will also look at adding a requirement under section 18 for public bodies to make a formal undertaking in the data-sharing agreement to abide by the principles of data protection as set out in Article 5 of the GDPR. This will address the various amendments the Senator proposed requiring public bodies to have regard to necessity and proportionality of sharing. I note the Senator's strong views on the obligation to use a base registry under section 42. While the scope for accepting changes is limited, I will examine the section again to see if any amendment might be possible. The Attorney General is also considering a technical amendment that may be required for this section.
I will table amendments to section 44, as I outlined during the discussions on amendments Nos. 20, 21, 22 and 22a. As we have discussed, I will re-examine sections 47 and 48 to see what might be done to address the provisions concerning the composition of the data governance board and its committees. I have accepted amendment No. 24dto section 48, subject to the wording being in order. If a technical amendment is required here to give full effect to this, I will table the amendment on Report Stage.
I propose to amend section 55(1)(b) to provide that the parties to a data sharing agreement shall outline whether they considered carrying out a data protection impact assessment. This is the best way to address the issues raised by Senator Alice-Mary Higgins in amendment No. 15. I will table an amendment to section 62 to provide for a minimum two-week consultation period for the data sharing agreement, in accordance with the commitment I made during the discussion on amendment No. 25. I will consider making an amendment to section 64 to provide that the Minister shall issue a rule, procedure or standard on suitable safeguards to protect against inappropriate accessing or processing of data shared under the Bill. Hopefully, this will address the issues raised by the Senator in amendment No. 10.
Finally, I will table an amendment to add the National Shared Services Office to the list of specified bodies under the Social Welfare Consolidation Act 2005. Members may recall that the office was established as a separate legal entity from the Department of Public Expenditure and Reform by legislation enacted last year. There is a need to create a specific legal basis for the office to process personal public service numbers, PPSN, and public service identity data as part of its activities.