---

Criticism of DPC confidentiality change ‘misguided’

Lawyers at McCann FitzGerald say that some of the commentary on a change in data-protection legislation that relates to information provided to the Data Protection Commission (DPC) has produced “more heat than light”.

A new section 26A of the Data Protection Act 2018 provides that the watchdog may, in specific circumstances, issue a notice requiring a person not to disclose specified information provided to them by the DPC, subject to limited exceptions.

The section was introduced by the recently enacted Courts and Civil Law (Miscellaneous Provisions) Act 2023.

The change was added by the Government at the final stages of the bill, prompting criticism from the Irish Council of Civil Liberties, which argued that it would prevent people from speaking about how the DPC handled their complaint, and would make it “impossible” for journalists to properly report on the supervision of ‘Big Tech’ firms.

‘Limited’ categories

In a note on the firm’s website, however, the McCann FitzGerald lawyers say that, leaving aside the method and timing of its introduction, much of the substantive criticism of the amendment “seems misguided”.

“Section 26A does not provide for a general ability for the DPC to ‘gag’ anyone,” they write.

“Instead, it enables the DPC to impose confidentiality obligations on limited categories of people, in respect of limited categories of information, in limited circumstances,” the lawyers add.

McCann FitzGerald says that the change is intended to enable the DPC to share information with complainants or other participants in investigations, inquiries or complaints that will enable them to participate more fully in the process, without jeopardising its integrity or the ability of the DPC to perform its statutory function in relation to the relevant process.

The firm’s lawyers point to a number of limitations on the ability of the DPC to impose confidentiality obligations – including where information was given in confidence, and on the understanding that it would be treated as confidential, and where disclosure could “reasonably be expected” to prejudice the effectiveness of the DPC’s performance of its functions.