Members of the Oireachtas Leinster House, Kildare Street Dublin 2 By
Total Page:16
File Type:pdf, Size:1020Kb
Members of the Oireachtas Leinster House, Kildare Street Dublin 2 By Email 23 February 2021 Dear Deputies, The Irish Council for Civil Liberties and Amnesty International understand that there will be a vote in Dáil Éireann on Thursday 25 February on a proposal to extend the term of the Commission of Investigation into Mother and Baby Homes. We urge you to support the extension of the Commission. We believe the Commission must be extended until such time as the Data Protection Commission and any other body has concluded investigations into the legality of the destruction of audio recordings of testimonies given to the Confidential Committee. Survivors have been asking for access to the transcripts of the evidence they gave to the Confidential Committee for years.1 They were and continue to be legally entitled to access the records of their evidence. The intimate nature of these records means that they are not only personal data protected by the GDPR, and the Irish Data Protection Act 2018, but are also “special category data” that enjoy particular protections under Article 9 of the GDPR. Special category data are defined in Article 9 as: …personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation… The deletion of records may infringe Article 5(1)f of the GDPR, which provides that personal data shall be: 1 See 2019 article https://edition.cnn.com/2019/09/07/europe/ireland-mother-and-baby-homes-intl/index.html processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). (emphasis added). In addition, the processing of survivors’ data to delete them without a lawful basis may infringe Article 6 and Article 9(2)a of the GDPR. Survivors were given an information form before giving testimony to the Confidential Committee. This form states that evidence given will be recorded and notes will be taken of the survivors’ accounts. It does not state anywhere on the information form that the records or recording will be destroyed.2 It is clear that many survivors did not give clear consent to the destruction of their personal data. On the contrary, we have been reliably informed that many survivors in fact expressed their wish to access copies of transcripts of their evidence. Article 4(11) of the GDPR defines consent as the following: ‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Article 9(2)a creates a higher bar for “explicit” consent, which applies to special category data. In addition, to the potential that Article 5(1)f, Article 6, and Article 9(2)a have been infringed, we are also concerned that the deletion of the data without accountability or transparency may have infringed Article 5(1)a, and Article 5(2). Therefore, the Data Protection Commission should be enabled to investigate several potentially serious infringements of data protection law. S.42 of the Commission of Investigation Act 2004 requires the Commission to “deposit with the specified Minister all evidence received by and all documents created by or for the commission”. This creates a statutory duty to lodge all evidence with the Minister. The Commission must explain why the decision was made to destroy evidence, apparently in contravention of its statutory duty. S. 7 of the National Archives Act requires specific authorisation for the destruction of records.3 The Commission must explain whether there was specific authorisation given to the Commission under this section. The decision to destroy records of the Confidential Committee must be interrogated given the serious possibility that the decision violated not just the personal data rights of survivors under the GDPR but potentially other laws around the retention and destruction of records. The life of the Commission must be extended until such 2 This information form can be read online here: http://clannproject.org/wp-content/uploads/Information-for- Witnesses-at-the-Confidential-Committee.pdf 3 http://www.irishstatutebook.ie/eli/1986/act/11/section/7/enacted/en/html#sec7 questions are properly resolved and addressed. Accountability is important if our laws are to have meaning. We again urge you to vote to extend the Commission. Yours sincerely, Liam Herrick Executive Director Irish Council for Civil Liberties Colm O’Gorman Executive Director, Amnesty International .