I understand that Deputy is referring to the order of the High Court granted by Mr Justice Owens pursuant to section 3A of the Communications (Retention of Data) Act 2011 (as amended by the Communications (Retention of Data)(Amendment) Act 2022) on 26 June 2023.
The order requires service providers to retain data in all of the categories specified in Schedule 2 of the Act for a period of 12 months for the purpose of safeguarding the security of the State. Previously such data was required to be retained by service providers on a general and indiscriminate basis pursuant to the 2011 Act without a requirement for an application to the High Court. Schedule 2 data identifies the forms of telephony and internet data (principally traffic and location data) which may be retained under the Act. As the Act makes clear it does not apply to the content of any communications. There were no further conditions and directions specified in the order.
As regards the designation of the relevant judge under section 3A(10), I wrote to the President of the High Court on 21 July 2022 in the context of preparations for the commencement of the 2022 Act asking that he give consideration to matter. On 29 July 2022, the President of the High Court designated Mr Justice David Keane and Mr Justice Alexander Owens as relevant judges.
As set out in the order (as notified to service providers and publicised in the national media last week in accordance with section 3A(6)) the Court granted the order on being satisfied on the basis of information sworn on my behalf, as Minister, that there exists a number of serious and genuine, present and foreseeable threats to the security of the State such that the order is necessary and proportionate for the purpose of safeguarding that security. The sworn information was based on my assessment of the threat taking into account the impact of such retention on the fundamental rights of individuals. My assessment was informed by inputs from An Garda Síochána, other relevant security information available to me, and information within my knowledge having regard to my ministerial responsibilities.
The legislation requires such an assessment to be conducted by the Minister prior to the making of any application and further requires that the Minister must be satisfied that there is a serious and genuine, present or foreseeable threat to the security of the State before making the application to the Court. The Court may only grant the application if satisfied that the making of such an order is necessary for, and proportionate to, the purposes for which the application was made.
As also required by the legislation, the application was made on an ex parte basis and was heard in camera.
As I hope the Deputy will appreciate, the application and proceedings concern sensitive matters - both the nature of the assessed threat and the manner in which the retention of the data - and ultimately access to that data by the competent bodies - can assist in combatting that threat. For sound reasons of national security it is not, therefore, possible for me to provide further detail on the specific threats grounding the application to the Court.
As regards the conduct of a data impact assessment, the circumstances in which a data controller is required to conduct a data impact assessment are set out in section 84(1) to (11) of the Data Protection Act 2018. In the case of the Communications (Retention of Data) Act 2011 (as amended) the conduct of such an assessment is not a matter for the Minister or the Minister's officials; rather it is a matter for each data controller concerned.
The Data Protection Commissioner was consulted on the 2022 Act when it was in draft form and also, more recently, on draft Regulations relating to the commencement of the 2022 Act as required by section 84(12) of the 2018 Act.
Neither the Data Protection Commissioner nor the Irish Human Rights and Equality Commission has a role under section 3A of the 2011 Act (as amended).
By way of general comment I would add that in circumstances where there is a serious, genuine and present or foreseeable threat to national security, the case law of the Court of Justice of the European Union makes it clear that Member States are not precluded from making provision for the preventative retention of traffic and location data, subject to such provision being subject to effective review, being limited in time to what is strictly necessary and being circumscribed by strict safeguards to protect effectively against abuse.
The provisions of the 2022 Act were enacted in light of the case law of the CJEU to bring certainty to service providers and competent bodies in relation to their obligations and to strengthen the safeguards applicable to the retention of, and access to, specified communications data.
