The Minister has made a Statement on the Government’s legal position on the application of the GDPR to ... well, to what exactly?

Let’s look at it together;

He goes on;

I mean, firstly, oh dear.

1) The Department or the Minister is not bound to accept the advice of the AG.

Ministers decide policy.

2) A national law can’t overrule an EU right, especially not one directly derived from the Charter.

It certainly can’t prohibit it.

3) Let’s all go look at Section 39, the impressively muscular piece of the Commissions of Inquiry Act 2004 which the Minister says can prohibit bits of EU law.

Let’s have a peep at the words.

It’s not long, don’t worry.
It’s quite straightforward.

Now, firstly, as Minister for Justice and The Commissioner of An Garda Síochana v WRC (Case C-378/17) confirms, sometimes there are national laws that just aren’t legal.

Laws that conflict with EU law are, strange as it sounds, illegal laws.

And the state must just ignore them.

So Section 39, says the AG, the Minister tells us, exempts the records from Article 15 Data Access Requests.

Except, as you can see, it doesn’t

It couldn’t, because it was passed in 2004 and the GDPR was passed in 2016.

It attempts negation Section 4 of the Data Protection Act

The 2018 Data Protection Act deals with the status of the old 1988 Act which this Section 39 addresses.

It was almost all repealed. Two acts were specified as able to rely on it still. Neither was the Commissions of Inquiry Act 2004.

Here, read it yourself.

To recap, the Ministers says the AG told him that a section of a national Act, which refers to a repealed law, prohibits the functioning of an EU Fundamental Right under the Charter.

This is deep into what might be termed “novelty”.

But if we’re down in this Governmental rabbit hole we might as well go on and meet the Queen and play the croquet match to the end.

Let’s go check how this time travelling 2004 law can rely on a 2018 Regulation provision to cancel that same EU law.

Time to look at Article 23.
“Restrictions”

Before we go in, let’s remind ourselves of the Minister’s claimed basis, on which his entire position rests, for asserting Section 39 of the 2004 Commissions of Inquiry Act can oust people’s GDPR data access rights.

An exception “relating to the administration of justice.”

OK.

Now, let’s check out the terms of the “administration of justice exemption”.

Oh.

It doesn’t exist.

But even if Section 39 of the Commissions of Inquiry Act 2004 was an exemption that fell into one of the existing grounds for restricting GDPR rights,
It still wouldn’t be legal.

You see, Article 23 has a second section, setting out requirements for national restriction laws

And Section 39... ain’t it.

The Minister described advice given by an unspecified AG on an unknown year (which may or may not be after the coming into force of the GDPR) which says an Irish law can prohibit an EU right, because it limits a different repealed law, based on a non existent restriction clause.

I thank you.

Not so fast, Elmo!
As @Cearta and @FitzTechLawIE have reminded me, we have one more strand of national law to deal with.

That is Section 198 of the 2018 Data Protection Act, which tried to save the blanket prohibition on Subject access requests.

They knew it was a Hail Mary.

So what we have here is a piece of national law seeking to restrict a Charter right as expressed in the GDPR.

That’s tricky at the best of times. It’s particularly tricky when the restriction you’re trying to bring in doesn’t cite one of the listed “Restrictions” of Article 23.

The old 1988 Act had a broad basis for restrictions radiating from the “administration of justice”. That was stretched to cover Commissions of Inquiry- dubiously.

But the new GDPR Article 23 restrictions had no such elastic.

(See little video above)

It has the much narrower clause permitting restrictions on the basis of

“(f) the protection of judicial independence and judicial proceedings”

But even the Minister doesn’t try to misapply that in his statement.

Which raises the question- just how old is this AG advice?

But let’s get to the meat of the S198 amendment.

It knows the game is up, really.

Because the CJEU has, by the time the GDPR came in, made clear it wouldn’t allow these blanket national carve outs, now the post-DRI Charter was determined as legally actionable.

Faced with this, we get the Hail Mary- the restriction might be allowed if it’s only enforceable to the extent it’s “necessary and proportionate”? Maybe? Will that do?, asks the Gov

They stick it in anyway, because, sure, you might as well make them fight you for their rights.

But here’s the thing. Chanting necessary and proportionate isn’t the magic spell the Minister hopes you think it is.

Time for us to meet the European Data Protection Board, the collective of all the Data Protection Authorities in the EU- including our own DPC.

In June 2020 they issued a collective policy paper on national restrictions to Data Protection rights- which were allowed and which were not valid and in what circumstances.

Here they are on the idea of just closing down a right

“If the essence of the right is compromised, the restriction must be considered unlawful, without the need to further assess whether it serves an objective of general interest or satisfies the necessity and proportionality criteria.”

Survivors of the Mother and Baby Homes will die before the Minister’s proposed 30 year seal of their personal data would end.

If that doesn’t restrict the “essence of the right” to access to the data about them, I can’t imagine what does.

This is the human reality of all these legal games. https://twitter.com/sharonlambert0/status/1319353697705525253

Later:

This is what it looks like to win an argument.
The Minister’s now saying he will make provision for personal access requests to his department.

There will be no 30 year seal.

https://www.irishtimes.com/news/politics/controversial-legislation-on-mother-and-baby-homes-records-passed-by-seanad-1.4389672?mode=amp