Opinion on the application of the Irish Constitution and EU General Data Protection Regulation to the Adoption (Information and Tracing) Bill 2016 and the Government’s ‘Options for Consideration’

Provided by the author(s) and NUI Galway in accordance with publisher policies. Please cite the published version when available. Title Author(s) Opinion on the application of the Irish Constitution and EU General Data Protection Regulation to the Adoption (Information and Tracing) Bill 2016 and the Government’s ‘Options for Consideration’ O’Mahony, Conor; Logue, Fred; O’Rourke, Maeve; Gallen, James; Daly, Eoin; Enright, Máiréad; Ring, Sinéad; McMahon, Rossa; Cahillane, Laura Publication Date 2019-11-05 Publication Information O’Mahony, Conor, Logue, Fred, O’Rourke, Maeve, Gallen, James, Daly, Eoin, Enright, Máiréad, Ring, Sinéad McMahon, Rossa, Cahillane, Laura. (2019). Opinion on the application of the Irish Constitution and EU General Data Protection Regulation to the Adoption (Information and Tracing) Bill 2016 and the Government’s ‘Options for Consideration’. Dublin: Adoption Rights Alliance Publisher Adoption Rights Alliance, Dublin Link to publisher's version http://adoption.ie/wpcontent/uploads/2019/11/OMahoney_Logue_ORourkeOpinion.pdf Item record http://hdl.handle.net/10379/15923 Downloaded 2020-05-15T00:08:39Z Some rights reserved. For more information, please see the item record link above. Opinion on the application of the Irish Constitution and EU General Data Protection Regulation to the Adoption (Information and Tracing) Bill 2016 and the Government’s ‘Options for Consideration’ dated 5th November 2019 Summary 1. This opinion discusses the application of both the Irish Constitution and the EU General Data Protection Regulation (GDPR) to the question of legislating to allow adopted people to know their identity at birth. 2. The opinion analyses the Government’s Adoption (Information and Tracing) Bill 2016, including the Government’s proposed amendments to that Bill.1 It takes into account the ‘4 Options for Consideration’ provided by Minister Katherine Zappone to stakeholders on 5th November 2019. It further considers the alternative legislative proposals put forward by a number of Senators in summer 2019.2 3. This document focuses on the parts of those varying legislative proposals that concern the release to an adopted person of sufficient information to enable them to access their publicly registered birth certificate in the General Register Office (GRO). 4. Although it is beyond the scope of this opinion, we note that the issue of access to files (beyond birth certificates) for parents and adopted people also raises significant questions of both constitutional and European data protection law and requires further considered analysis. 5. In summary, the opinion concludes that: • • • The Irish Constitution and the EU GDPR do not require the Oireachtas to establish a system whereby parents may object to their adult child receiving information that enables them to retrieve their publicly available birth certificate from the GRO. The Irish Constitution and the EU GDPR allow the Oireachtas to legislate to establish a system similar to that in Northern Ireland,3 whereby every adopted adult is entitled to their birth certificate following an information session if they were adopted prior to the introduction of the legislation, and questions of contact are addressed through a voluntary adoption contact preference register and a wellresourced voluntary tracing service. If the Oireachtas chooses not to legislate to ensure that every adopted person can access their birth certificate, any case-by-case decision-making procedure must be compatible with the EU GDPR because the GDPR is supreme over all Irish law including the Constitution. 1 As set out in Seanad Committee Stage amendments proposed by Government on 12th June 2019 (https://data.oireachtas.ie/ie/oireachtas/bill/2016/100/seanad/3/amendment/numberedList/eng/b10016s-scnl.pdf) and further in a Briefing for Senators by Minister Katherine Zappone dated 12th June 2019. 2 See Seanad Committee Stage amendments dated 12th June 2019 (https://data.oireachtas.ie/ie/oireachtas/bill/2016/100/seanad/3/amendment/numberedList/eng/b10016s-scnl.pdf) and Seanad Committee Stage additional amendments dated 19th June 2019 (https://data.oireachtas.ie/ie/oireachtas/bill/2016/100/seanad/3/amendment/numberedList/eng/b10016s-sc-1staddtnl-nl.pdf) . 3 See The Adoption (Northern Ireland) Oder 1987, section 54: http://www.legislation.gov.uk/nisi/1987/2203/article/54?view=extent 1 • • It is doubtful that the decision-making procedure proposed by the Government in the Adoption (Information and Tracing) Bill 2016, including ‘Option 2’ whereby a ‘presumption in favour of release’ would be stated in the Bill, is compatible with the provisions of the GDPR. ‘Option 3’ and ‘Option 4’ would, it seems, allow the GDPR to function freely in relation to the release of adopted people’s personal data. The Adoption (Information and Tracing) Bill 2016: What does it propose? 6. The Adoption (Information and Tracing) Bill 2016 seeks to restrict access to one’s identifying information for people adopted in the past while creating an automatic, unqualified right to one’s identifying information for those adopted in future. 7. ‘Option 1’ presented on 5th November 2019 would retain the Government’s Bill together with the Government’s proposed Seanad Committee Stage amendments4 and amendments it will propose at Seanad Report Stage.5 8. Under this approach, once an historically adopted adult requests the information that would allow them to retrieve their birth certificate from the GRO, the following process will be triggered: 4 5 • TUSLA will attempt to find and contact the person’s natural mother, and father if known (including by accessing the Department of Employment Affairs and Social Protection’s databases in order to find these individuals’ current address); • If either parent objects to the release to the adopted person of the information enabling them to retrieve their birth certificate, the Adoption Authority of Ireland will decide on the matter, having regard to the following factors and ’such additional matters as it considers appropriate’: See https://data.oireachtas.ie/ie/oireachtas/bill/2016/100/seanad/3/amendment/numberedList/eng/b10016s-scnl.pdf See Briefing for Senators by Minister Katherine Zappone dated 12th June 2019. 2 § § § § § § § § • The circumstances giving rise to the parent relinquishing charge or custody of the applicant; The present circumstances of the parent and the likely effect upon him or her of the provision to the applicant of the information concerned; The views of the parent on the provision to the applicant of the information concerned, and the reasons for these; The respective ages of the parent and the adopted adult; The reason for the adopted adult’s wish to have the information concerned provided to him or her and, where applicable, to contact the parent; Where applicable, the likelihood of the adopted adult, whether upon provision to him or her of the information concerned or at any point in the future, seeking to contact the parent in circumstances where the adopted adult has been informed that the parent does not wish to be so contacted; The present circumstances of the adopted adult and the likely effect upon him or her of a refusal to provide the information concerned to him or her; Current knowledge relating to the effect of provision or non-provision of information of such nature to persons seeking the information, on those persons and on persons who are the subject of the information. Following the Adoption Authority’s decision, there will be a right of appeal to the Circuit Court, and on a point of law to the High Court. 9. We understand that the Attorney General has advised the Government that the Irish Constitution requires the Oireachtas to establish a system that enables parents to object to their adult child being informed of their identity, following which a State authority will adjudicate each objection on a case-by-case basis. 10. As far as we can judge, the Attorney General’s advice to Government on the constitutional framework that applies to this issue is that it would be unconstitutional for the Oireachtas to legislate in a manner similar to Northern Ireland (in 1987) and England and Wales (in 1975) whereby every adopted person is entitled to their birth certificate upon reaching adulthood, whether they were adopted before or after the date of the relevant legislation’s enactment. 11. We explain below why the Attorney General’s understanding of how the Constitution interacts with the Oireachtas’ freedom to legislate in the area of access to adoption information is incorrect. 12. We contend further below that the GDPR does not require the Oireachtas to legislate in the manner proposed by the Government in the Adoption (Information and Tracing) Bill 2016. In our considered view, it is clearly permissible under the GDPR for the Oireachtas to follow the example of Northern Ireland and the other UK jurisdictions. We know of no GDPR-based challenges to, nor suggestions that the GDPR does not allow, the established systems of automatic provision of birth certificates to adopted people in the UK and in other European jurisdictions (discussed further below). 3 13. In fact, we contend below, the Oireachtas would likely be acting in contravention of the GDPR by establishing the procedure for responding to data access requests that the Adoption (Information and Tracing) Bill 2016 envisages. What are the ‘4 Options for Consideration’ proposed by Minister Zappone on 5th November 2019? 14. Under ‘Option 1’, the Government would proceed with the Adoption (Information and Tracing) Bill 2016 as planned in June 2019 and as explained above. 15. Under ‘Option 2’, the Government would make two major changes to its June 2019 proposals: (1) the Bill would state a ‘presumption in favour of release of information’. The Minister’s Briefing of 5th November 2019 explains this to mean that ‘where there is an objection to the release of birth information by the natural parent, if the case between the adopted person and the birth parent are equal, the Adoption Authority of Ireland will be obliged to release the information’; (2) the Bill would establish a ‘defined period’ for parents to ‘opt-in’ to state their objection to the release of information. Once an adopted person applied for their identifying information, it seems, the objection would activate and the case-by-case hearing procedure explained above would commence. If a parent had not ‘opted in’ to stating their objection, birth information would be released automatically to the adopted person upon their application. 16. Under ‘Option 3’, the Government would remove all provisions of the Bill relating to information access and instead provide only for safeguarding of records, tracing for the purposes of reunion, and putting the National Contact Preference Register on a statutory footing. 17. Under ‘Option 4’, the Government would remove all provisions of the Bill except for the safeguarding of records. What are the alternative legislative proposals? 18. At Committee Stage in the Seanad in June 2019, several Senators put forward alternative legislative proposals (through a large volume of tabled amendments) which would establish a system of access to information similar to that prevailing in Northern Ireland and England and Wales. In those jurisdictions (where the GDPR similarly applies), where an adoption took place before the enacting legislation, the adopted adult is entitled to know their original identity following an information session. Those jurisdictions also operate voluntary contact preference registers which enable adopted people and parents to make their relatives aware of their preferences regarding contact, and to withhold their contact details should they not wish to have contact made with them. 4 Constitutional Law analysis 19. In our opinion, it is well within the scope of constitutionally permissible actions for the Oireachtas to establish a scheme of automatic access for all adopted people to their original identity, coupled with a fully resourced and regularly advertised voluntary National Adoption Contact Preference Register (NACPR) and voluntary tracing service. 20. Regarding the desire of some adopted people and natural parents not to receive contact from one another, the Government can discharge its constitutional obligation to respect these individuals’ privacy rights (while also respecting the right to identity of adopted people) through the effective operation of the NACPR, including via an awareness campaign in advance of the legislation’s enactment. The NACPR allows every person affected by adoption to register their preference regarding contact with a family member and to choose whether to provide or withhold their contact details. Furthermore, where required, the ordinary civil and criminal legal frameworks concerning harassment are available to every person in Ireland—although it is crucial to note that the Government has provided no evidence that any harassment has occurred in all of the previous decades during which natural parents and adopted people have been making contact with each other independent of church or State services and in the absence of legislation. 21. The Government’s advice appears to be that, due to the Supreme Court’s decision in IO’T v B [1998] 2 IR 321, any legislation that regulates the release of historical adoption information must ensure that the rights of the adult child and the natural parent are balanced specifically by way of (1) allowing each natural parent to object to the release of their name to their now-adult child, and (2) where either parent so objects, ensuring that a State body makes an individualised decision on whether or not to release the information, taking into account an undefined range of factors. 22. However, in our view, IO’T v B has no bearing on how the Oireachtas should legislate save for the Supreme Court’s acknowledgement that the Constitution protects both the right to identity and the right to privacy and that these rights must be balanced in relation to each other. 23. IO’T v B was not a case in which the constitutionality of legislation was challenged; it was decided in a legislative vacuum insofar as the provision of records was concerned. Thus, the key points made in the judgment were not addressed to the Oireachtas. On the contrary, since the judgment was a case stated from the Circuit Court, the judgment took the form of a series of answers to specific questions posed by the Circuit Court judge. When the Court held (at p.353) that the natural parent had a right to fair procedures which involved being able to assert privilege or a right to privacy, that point was made in the specific context of answering questions from a Circuit Court judge about how he should decide an application to the Court. The right arose in the context of those court proceedings. It would misconstrue the judgment to interpret it as holding that the same requirements apply to any legislation enacted by the Oireachtas on this point. 24. The factors laid out (at p.355) to be taken into account when deciding whether to release the information were to be taken into account by the Circuit Court in the context of providing fair procedures during a decision-making process that took place in a legislative vacuum vis-à-vis how the rights of the parties were to be balanced. This does not mean that the same factors must feature in legislation passed by the Oireachtas. The relevant passage opens with the words “In the particular circumstances of this case …”. Moreover, 5 the Supreme Court states that these are factors which the Circuit Court judge is “entitled” rather than obliged to consider. 25. Furthermore, the issue of access to publicly available birth certificates was not expressly addressed in IO’T v B. Since 1864 (under the Registration of Births and Deaths (Ireland) Act 1863), all births in Ireland have been registered publicly and all mothers have been required to be named on their child’s birth certificate. This is contrary to the situation in France and Italy, which uniquely operate explicit and procedurally clear systems of ‘anonymous birth’ allowing mothers to avoid being registered on the child’s birth certificate or publicly in the rare circumstances where they wish to do so.6 It must be presumed that Ireland’s legislative system of open access to birth registration, which has continued to operate without interruption post-independence, is constitutional. In fact, in the Civil Registration Act 2004, which was enacted post-IO’T, provision was made to restrict access to the index that makes traceable the link between the Adopted Children’s Register and the Register of Births but no such limitation was placed on access to the register of births. 26. Legislation could protect the right to privacy of everyone concerned through means other than an individual hearing in which a natural parent is pitted against their adult child. In the earlier version of the Bill, it was deemed that the requirement that the adopted person sign an undertaking not to seek to contact the natural parent provided sufficient legal protection for the right to privacy. This requirement did not involve any individual hearing. Therefore, if an individual hearing is not a constitutional requirement, the right to privacy could also be adequately protected through other means – for example, through affording adopted people and natural parents the opportunity to register their contact preference, and requiring applicants for information to attend a meeting at which they would be informed of this preference. Indeed, in many ways, this would provide more robust protection for the privacy of both adopted people and natural parents expressing a wish for no contact than the Government’s proposals to date. 27. The Court in IO’T did not intend to restrict the freedom of action of the Oireachtas; this point was not up for consideration in the case. On the contrary, at pp.340-341 the Court cited with approval the classic passage from Ryan v AG7 regarding the presumption of constitutionality applying with particular force to legislation enacted by the Oireachtas for the purpose of reconciling the exercise of constitutional rights with the claims of the common good. Viewed in this light, the decision is entirely in line with recent Supreme Court decisions in which the preference of the courts to defer to decisions made by the Oireachtas on sensitive matters of social policy, and their reluctance to strike down laws of this sort, has been repeatedly re-affirmed. 28. In Fleming v Ireland, the Supreme Court stated that “[t]he presumption [of constitutionality] may be regarded as having particular force in cases where the legislature is concerned with the implementation of public policy in respect of sensitive matters of social or moral policy.”8 The challenge to the law in that case was rejected on the basis that “the legislation in question called for a careful assessment of competing and complex 6 See Godelli v Italy (ECtHR, Application no 33783/09) 25 September 2012 and Odièvre v France (2004) 38 E.H.R.R. 43. See further Alice Margaria, ‘Anonymous Birth: Expanding the Terms of the Debate’ (2014) 22 International Journal of Children’s Rights 552. 7 8 [1965] I.R. 294 per Kenny J at 312. [2013] 2 I.R. 417 at 441. 6 social and moral considerations. That is an assessment which legislative branches of government are uniquely well placed to undertake.”9 Similarly, in MR v An tArd Chláratheoir,10 Chief Justice Denham commented that “[a]s a significant social matter of public policy it is clearly an area for the Oireachtas, and it is not for this Court to legislate on the issue … Any law on surrogacy affects the status and rights of persons, especially those of the children; it creates complex relationships, and has a deep social content. It is, thus, quintessentially a matter for the Oireachtas.”11 Similarly, Mr Justice Murray commented that “[i]t is for the Oireachtas to make the value judgement based on best policy …”12 In MD (a minor) v Ireland, the Supreme Court rejected the challenge by stating: “This was a choice of the Oireachtas. Even in a time of social change, it is a policy within the power of the legislature … The Oireachtas could have applied a different social policy but s. 5, the policy which they did adopt, was within the discretion of the Oireachtas, and it was on an objective basis, and was not arbitrary.”13 29. Moreover, where the legislature passes legislation that balances conflicting constitutional rights, the courts afford even more deference to the legislature and are even more reluctant to invalidate such a law. This was established in the case of Tuohy v Courtney,14 which involved a constitutional challenge to the Statute of Limitations on the basis that it barred the action of the plaintiff even where he was not aware of the damage he had suffered— and so could not have brought his claim—until after the time bar had elapsed. This interfered with a previously-established constitutional right to succeed in litigation.15 However, the Statute of Limitations balanced this right with another, previouslyrecognised: the right to be free of unjust and delayed litigation.16 The Supreme Court held that where legislation that restricts constitutional rights involves balancing two or more sets of directly conflicting constitutional rights—as opposed to balancing one set of rights with state interests—a more deferential standard of review applies: “The Court is satisfied that in a challenge to the constitutional validity of any statute in the enactment of which the Oireachtas has been engaged in such a balancing function, the role of the courts is not to impose their own view of the correct balance in substitution for the view of the legislature as displayed in their legislation but rather to determine from an objective stance whether the balance contained in the impugned legislation is so contrary to reason and fairness as to constitute an unjust attack on some individual’s constitutional rights.”17 30. Thus, in order for legislation in the area of adoption information and tracing to be deemed unconstitutional, it must be shown that the law is arbitrary and lacks an objective basis. It is on this basis that we submit that the Constitution does permit the Oireachtas to legislate in the manner proposed by several Senators earlier this year: providing automatic access to identifying information for people who were adopted in the past following an 9 Ibid. [2014] I.E.S.C. 60. 11 Ibid at [96] and [113]. She went on to say at [118] that “The issues raised in this case are important, complex and social, which are matters of public policy for the Oireachtas. They relate to the status and rights of children and a family.” 12 Ibid at [63]. 13 [2012] 1 I.R. 697 at 719. This was quoted with approval by the Supreme Court in Fleming v Ireland [2013] 2 I.R. 417 at 441. 14 [1994] 3 IR 1. 15 This right had been recognised in the case of O’Brien v Keogh [1972] IR 144. 16 This right had, according to the Tuohy Court, been found in O’Domhnaill v Merrick [1984] IR 151. 17 [1994] 3 IR 1 at 47. Emphasis added 10 7 information session, and accompanied by a fully resourced voluntary National Adoption Contact Preference Register and voluntary tracing service. EU GDPR analysis Could the Oireachtas legislate to allow all adopted people to know their identity? 31. It is our considered view that nothing in the EU GDPR prevents the Oireachtas from legislating to ensure that all adopted adults are provided with the information they need to retrieve their publicly available birth certificate from the GRO. 32. As explained above, in Northern Ireland (since 1987)18 and England and Wales (since 1975),19 every adopted adult is entitled to their birth certificate. In these jurisdictions, people adopted before the date of the legislation’s enactment must first be provided with information about the context(s) in which their adoption may have taken place. These jurisdictions also operate voluntary contact preference registers. Numerous other European Union jurisdictions provide all adopted adults with access to their identity. We understand these jurisdictions to include Germany (since 1957),20 Belgium (since 1960),21 Austria (since 1983),22 the Netherlands (since 1994),23 Spain (since 2007 for those adopted internationally and 2015 for those adopted domestically)24 and Sweden.25 It can be assumed that the GDPR was not intended to render invalid such laws across a large number of EU Member States. 33. A person’s identity at birth is their ‘personal data’, according to the Article 4(1) GDPR definition, as follows: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or 18 The Adoption (Northern Ireland) Order 1987, section 54. Children Act 1975, section 26. 20 Sections 62 and 63 of the German Act on Personal Statute ("Personenstandsgesetz"), entered into force in 1957. 21 From Hogan Lovells International LLP: ‘An adoptee can have access to his or her original birth certificate. This is a Federal competence and is applicable in the whole of Belgium. Unless the mother eluded Belgian legislation by for example giving birth in France (anonymously), the birth certificate will always include at least the name of the mother. After contacting the Flemish adoption authority, they explained that this has been the case since at least 1960 in the whole of Belgium.’ 22 From Hogan Lovells International LLP: ‘In Austria, adopted people are generally entitled to access their birth records, including the following information regarding their parents: name, date and place of birth and death, marital status and nationality (Sections 2 and 52/2 of the Austrian Personal Statute Law 2013). This applies since 1983. This also applies to incognito adoptions, although the access is limited to those who are 14 years or older. These regulations are considered as being consistent with Article 8 ECHR.’ 23 See Trstenjak, V. and Weingerl, P. (Eds) (2016) The Influence of Human Rights and Basic Rights in Private Law. Dordrect: Springer. (Pages 49-50; 462-463) 24 From Hogan Lovells International LLP: ‘In theory, access to records is a possibility since 1958, but in practice it was only possible when the files after appealing in court and permission was only granted in limited cases. Since 2007 (for international adoptions) and since 2015 (for national adoption) access to files is finally truly legally granted.’ 25 See Yngvesson, B. (2010) Belonging in an Adopted World: Race, Identity and Transnational Adoption. Chicago: University of Chicago Press. (Page 24). 19 8 more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. 34. As the Court of Justice of the European Union (CJEU) acknowledged in Nowak v Data Protection Commissioner of Ireland (Case C-434/16, 20 December 2017), information may be linked to more than one individual and this does not affect the right of access: ‘The same information may relate to a number of individuals and may constitute for each of them, provided that those persons are identified or identifiable, personal data’ (para 45 of the Nowak judgment). 35. The Government, and indeed other State and non-State controllers of adopted persons’ personal data, appear to be proceeding on an incorrect interpretation of ‘personal data’ and ‘third party data’ under the GDPR. It seems that these bodies have decided that an adopted person’s birth name, their birth certificate and the name of their parent is ‘third party data’ (rather than a form of mixed personal data belonging to both parent and child). This is a fundamental misunderstanding of the relevant law. 36. According to Article 6.1(c) of the GDPR, data processing is lawful where it is ‘necessary for compliance with a legal obligation to which the controller is subject’. Therefore, as long as the Oireachtas legislates specifically to allow the release of adopted people’s identifying data (e.g. by the Adoption Authority of Ireland), such release will in principle comply with the GDPR. 37. Under EU law, in addition to complying with the GDPR, Irish legislation governing the release of adopted people’s identifying information must be compatible with the EU Charter of Fundamental Rights. Similarly to the position under the Irish Constitution, in our opinion, the Oireachtas enjoys considerable latitude under the EU Charter to reach a broad legislative arrangement that, in its view taking into account all relevant factors, is a proportionate balancing of the privacy rights (including the right to identity) of adopted people and their parents. We believe that a legislative regime similar to that pertaining in our neighbouring jurisdictions – as described above – would meet the requirements of the EU Charter, as well as the GDPR. 38. An example of Irish legislation mandating the release of personal data is, of course, the existing civil registration system. Since the foundation of the Irish State, the law has required public registration of all Irish births. All Irish birth certificates since 1864 are currently available to the public in the GRO. This means that the natural mothers (and, if registered, natural fathers) of adopted persons are already publicly identifiable in the GRO. Unlike France and Italy, for example, Ireland has never operated any legislative system of ‘anonymous birth’. Although adopted adults generally do not know their identity at birth and therefore cannot easily find their birth certificate in the GRO, significant numbers of adopted people have been able to locate their birth certificate through a process of elimination using a variety of personal details known to them. 39. In the case of Manni (Case C-398/15, 9 March 2017) the CJEU held that, as a matter of European Law, it is permissible for Member States to publish company registers without the possibility for individuals to have their personal data deleted or removed from the register. The Court found that legislation providing for the mandatory publication of company registers served a public interest and was lawful since it did not result in a disproportionate interference with the fundamental rights of the persons concerned, and 9 that nothing in EU law created an obligation to provide for erasure of personal data pursuant to an individual request. 40. By analogy, the disclosure of their own information to adopted people serves a public interest in making information about their origins available to them. Legislation providing open access without the possibility that another person could object or prevent access to this information would be compatible with EU law as long as it did not generally constitute a disproportionate interference with the fundamental rights of others. Safeguards to ensure that others’ rights were not disproportionately affected by the release to all adopted people of the information enabling them to retrieve their birth certificate could include measures such as a national advertising campaign informing the public of the incoming legal measures and the existence of the voluntary National Adoption Contact Preference Register (NACPR), and the provision of advice about the purpose and operation of the NACPR to every adopted person prior to releasing their information. 41. In any event the Government would first need to precisely establish, based on objective fact and taking account of Ireland’s existing public birth registration system, how any proposed open access legislation would affect the fundamental rights and freedoms of others.26 If the Oireachtas does not legislate to allow all adopted people to know their identity, what are the requirements of a case-by-case decision-making procedure according to the GDPR? 42. The proposals under Option 1 and Option 2 must, by virtue of EU law, be without prejudice to data subject rights. It has been established since the earliest judgments of the Court of Justice that EU law has ‘primacy’ over domestic law including data protection. This means that, even if the Irish Constitution were to be interpreted in a contrary manner to how we interpret it above, the GDPR takes precedence. 43. According to article 15 GDPR, every person has a right to access personal data relating to themselves (which – as explained above – includes their identity). This right applies equally to personal data that relates to themselves only and personal data that also relates to other people (for example a mother or other family members)27. The data controller (i.e. the person or persons who determine the purpose or means of processing) has a statutory obligation to give a copy of the personal data to the data subject on request. Article 15(4) GDPR states, however, that the right of access cannot adversely affect the fundamental rights and freedoms of others. 44. The precise scope of article 15(4) GDPR has not been considered by any court that we are aware of. According to general principles of European human rights law, any limitation on the data subject’s right of access pursuant to article 15(4) or otherwise would have to 26 It is a long-standing principle espoused by the European Court of Human Rights and incorporated into European Union law that, in order to be permissible, limitations on rights have to be provided by law so that they are foreseeable, must genuinely meet an objective of general interest, be necessary to meet that objective and not represent a disproportionate interference with fundamental rights. See European Data Protection Supervisor, Assessing the necessity of measures that limit the fundamental right to the protection of personal data: A Toolkit, https://edps.europa.eu/sites/edp/files/publication/17-04-11_necessity_toolkit_en_0.pdf; see further CJEU (Grand Chamber), Case Opinion 1/15 (26 July 2017), para 121 onwards, https://eur-lex.europa.eu/legalcontent/EN/ALL/?uri=CELEX%3A62015CV0001%2801%29. 27 Case C-434/16, Nowak, paragraph 44. 10 be a necessary and proportionate restriction on the basis of a fundamental right or freedom precisely and objectively established to exist. Taking account of Ireland’s existing civil registration system, it is not clear to us that access to a public record such as a birth certificate could activate this limitation on the right of access. Furthermore, the blanket restriction on access to other identifying information in section 40(1)(a) of the Adoption (Information and Tracing) Bill 2016 appears too broad to comply with article 15(4). 45. The GDPR allows Member States to introduce restrictions to this right (and other data subject rights) through legislation that satisfies the criteria set out in article 23 GDPR. This article provides that Member States may restrict data protection rights by legislative measures which are necessary and proportionate in a democratic society to safeguard certain public interest factors which are listed in article 23(1).28 Article 23(2) lists elements that must be present in any legislation restricting rights. Ireland has already enacted various restrictions in Chapter 3 of the Data Protection Act 2018 to safeguard, for example, cabinet confidentiality, criminal investigations, and so on. Nonetheless, any restrictions to a fundamental right are meant to be interpreted restrictively and can only be introduced insofar as they are strictly necessary and proportionate to safeguard identified public interest factors or the rights and freedoms of others. Again, taking account of Ireland’s existing civil registration system, it is not clear to us that access to a public record such as a birth certificate could be restricted under this provision of the GDPR. The blanket restriction on access to other identifying information in section 40(1)(a) of the Adoption (Information and Tracing) Bill 2016 further appears to us to be over-broad having regard to the provisions of article 23 GDPR. 46. Procedurally, it is not entirely clear to us that the case-by-case decision-making process proposed by the Government in the Adoption (Information and Tracing) Bill 2016, including ‘Option 2’ whereby a ‘presumption in favour of release’ would be stated in the Bill meaning that release of information would be granted unless the birth parent objects in which case the Adoption Authority of Ireland would decide whether or not to release information, is compatible with the provisions of the GDPR. 47. The first issue with introducing what amounts to a third access regime that would sit alongside the FOI Act and GDPR is that it is bound to create confusion which could result in the weakening of data subject rights. 48. The second and more important issue is that every data controller is tasked under GDPR to grant data subjects access to their personal data. Under the Adoption (Information and Tracing) Bill 2016, it appears, the Adoption Authority of Ireland (AAI) will be required to make decisions regarding the release of data held in many instances by TUSLA. There is no provision under EU law for this responsibility to be devolved to an independent body such as the AAI. In any event it is for the Data Protection Commission to supervise compliance with GDPR by controllers; therefore the proposal to use the AAI as an 28 (a) national security; (b) defence; (c) public security; (d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; (e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security; (f) the protection of judicial independence and judicial proceedings; (g) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions; (h) a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g); (i) the protection of the data subject or the rights and freedoms of others; (j) the enforcement of civil law claims. 11 appellate or decision making body would interfere with that jurisdiction which is derived from Article 8 of the Charter of Fundamental Rights of the European Union. 49. ‘Option 3’ and ‘Option 4’ would, it seems, allow the GDPR to function freely in relation to the release of adopted people’s personal data. Dr Conor O’Mahony Senior Lecturer in Constitutional Law and Child Law University College Cork Dr Fred Logue Principal, FP Logue Solicitors Dr Maeve O’Rourke Lecturer in Human Rights Law Irish Centre for Human Rights, NUI Galway Dr James Gallen Lecturer in Law School of Law and Government, Dublin City University Dr Eoin Daly Lecturer in Constitutional Law School of Law, NUI Galway Máiréad Enright Reader in Law Birmingham Law School, University of Birmingham Dr Sinéad Ring Assistant Professor of Law School of Law, Maynooth University Rossa McMahon Solicitor, PG McMahon Solicitors Dr Laura Cahillane Lecturer in Constitutional and Administrative Law University of Limerick 12