No apologies have been received. I remind members to turn off their mobile phones or to switch them to flight mode.

The purpose of this meeting is to receive an oral briefing on the general scheme of the criminal justice (international cooperation office) Bill 2025. To provide that briefing, we are joined by the following officials from the Department: Mr. Jimmy Martin, adviser and former assistant secretary in the area of criminal justice legislation; and Mr. Fiachra Byrne, principal officer for criminal legislation. They are both very welcome. I will invite the officials to brief the committee on the proposed legislation and then call on members in the order that they indicate to put any questions. In order to manage the committee's time effectively, it is proposed that each member will have an initial seven minutes. This is for questions and answers. There may be an opportunity to have a second round of questions.

Before I invite the officials to deliver their opening statement, I wish to advise them of the following in relation to parliamentary privilege. Witnesses and members are reminded of the long-standing parliamentary practice that they should not criticise or make charges against any person or entity by name or in such a way as to make him, her or it identifiable or otherwise engage in speech that might be regarded as damaging to the good name of the person or entity. Therefore, if their statements are potentially defamatory in relation to an identifiable person or entity, they will be directed to discontinue their remarks. It is imperative that they comply with any such direction.

I invite Mr. Martin to make his opening statement on behalf of the Department.

I will start by providing some background. E-evidence, namely evidence held in electronic form, particularly in the form of social media or electronic communications such as emails, is now relevant in most criminal investigations. Within the European Union, such services are frequently provided by one of the large service providers, which may only have a physical presence in one of the member states. Traditionally, jurisdiction is exercised by the courts based on the physical presence of a body, in the sense of a legal or natural person, or evidence in that jurisdiction. However, a person residing in Belgium, for example, who commits a crime in Belgium may now be using some form of electronic communication or social media that the police want to access and what would formerly have been a domestic investigation suddenly has an international dimension. The traditional forms of judicial mutual assistance in gathering evidence from another country are quite complicated and take some time. To address this problem, the European Union adopted the e-evidence package in July 2023. This is made up of a regulation and a directive, the details of which are in the note I provided.

The regulation, which has direct effect and becomes applicable without transposition, provides for a system whereby a judicial authority in one member state, the issuing state, can order a service provider based in another member state, the hosting state, to produce electronic evidence it possesses for the purpose of criminal investigations and proceedings. This is done without the need for a court order in the hosting state. There are a number of safeguards set out in the regulation in addition to safeguards under national law. The hosting state has to have an enforcing authority. In addition to its enforcing role, it has a safeguarding role and, in certain circumstances, it can intervene on its own initiative or at the request of the service provider and determine that an order should be refused on the grounds set out in the regulation.

The directive, which is to be transposed into Irish law by means of the proposed Bill, requires service providers offering services within the European Union to formally designate at least one point of contact in a member state to receive and process orders made under the regulation.

The latter could be one contact point for the entire European Union. Member states have to appoint central authorities to ensure that the requirements in the directive are complied with and that authority to do this must have the power to impose penalty on service providers for non-compliance.

The main purpose of the proposed Bill is to give effect to the e-evidence directive and to provide for the establishment of a body that will be the central authority required by the directive, and the enforcement authority required by the regulation. In an effort to avoid creating a new body, the Department spent some time exploring whether an existing body under the aegis of the Department or other Departments could carry out the tasks required. However, no appropriate body could be identified. There are three key criteria that need to be considered in this context. The authority will be facilitating the gathering of evidence for criminal investigations. It will have a criminal-justice-only purpose. It will have to be in a position to impose significant administrative fines and cope with a large number of European orders per annum. I will expand a little on these three criteria.

The e-evidence package involves a completely new approach to the gathering of e-evidence across borders. As already stated, the traditional approach to gathering evidence in criminal proceedings would have required a request from a judicial authority in the issuing member state for a court order in the hosting state. The new EU approach does away with the involvement of the courts in the hosting state. There is no existing criminal justice body that is equipped to deal with these tasks because they are completely new in the context of our criminal justice system.

The enforcement authority has to be in a position to make findings that a service provider is not in compliance with its obligations and has to be in a position to impose administrative fines up to 2% of the total worldwide annual turnover of the service provider. Fines, in theory, could exceed several billion euro.

A significant number of the largest social media and electronic communications service providers have their European presence in Ireland. Up to 600 service providers may designate a contact point in Ireland under the directive. Therefore, Ireland is likely to be responsible for the enforcement of the majority of all European production orders coming from the other 26 members states. In that role, it is estimated that Ireland could receive in excess of 300,000 orders in total per annum from the other member states.

As a result of these factors, on 3 June last, the Government approved the establishment of a new body to act as the central authority and enforcement authority and approved the priority drafting of the general scheme of the criminal justice (international co-operation office) Bill 2025. When approving the establishment of this new body, the Government took cognisance of the fact that it is likely to be given further tasks in the area of criminal justice. Particular note was taken of the intention of the Minister to bring forward proposals to give effect to the directive regarding the European investigation order.

Turning to the general scheme, the first section is technical. Part 2 provides for the establishment of the new body. There are very tight deadlines to be met because states are required to bring in laws by 18 February 2026 to give effect to the directive. Service providers will have up to 18 August 2026 to designate their contact point and notify the central authority in Ireland. The regulation will then apply with full force from 18 August 2026. European production orders may be issued at that stage. As a result, the Irish enforcement authority should be operational at that stage if we are to meet our obligations.

The legal structure chosen is that a person will be appointed director and shall be a corporation sole with perpetual succession. He or she will have a legal existence separate to the Minister, and will be independent. The director will have an office of staff to support him or her. To allow operations to start quickly, the onus will be on the Department of Justice to find office space, allocate staff and provide support in the IT, HR and finance functions but that will not interfere with the independence of the director and the staff of the office.

The primary functions of the director are listed in head 2.4 and are, to a large degree, dictated by the EU instruments. One of the most important ones is the enforcing authority. The regulation sets out the conditions for issuing orders, which must be necessary and proportionate, and respect the fundamental rights and legal principles enshrined in the EU Charter. There is an additional safeguard, where the offence did not take place in the issuing state, or where the person whose data is sought does not reside in the issuing state, the enforcement authority must be notified and may raise grounds for refusal. There is also a provision in Article 10 whereby the service provider may raise issues with the enforcing authority and seek to have grounds raised there.

In addition to that safeguarding role, the enforcing authority will also deal with non-compliance with an order by a service provider and may issue significant fines. The procedure for issuing fines is set out in Part 4.

In addition to being the enforcing authority, it will also have a role as the central authority under the directive. The director will have to oversee compliance by service providers with the following obligations, namely: service providers must designate a contact point within the EU for a receipt of European production orders; the contact point must be properly resourced; and service providers must notify the details of the contact point and the languages used to the central authority. As the body responsible for ensuring compliance, the director must co-ordinate with central authorities in other member states to ensure that the directive is applied in a consistent and appropriate manner.

Part 3 sets out the obligations of the service providers, transposing them directly from the directive. As I already referred to the main obligations, I will not repeat them.

Part 4 deals with sanctions. As mentioned, the directive will have to impose administrative sanctions under the regulation and the directive. The procedure and the maximum fine to be imposed is set out in detail in the regulation. In the case of the directive, it is a matter for the discretion of Irish law. In both cases, the procedures for imposing administrative fines are based on existing procedures set out in Irish legislation. The model we used was Part 8B of the Broadcasting Act 2009, as amended, which provided a model for Coimisiún na Meán, which can hold similar type fines. We are happy to answer any questions the members wish to raise.

I thank Mr. Martin. I will open the floor to members, beginning with Deputy Gannon.

I thank the officials for the briefing. Going through the statement, it is anticipated that there could be over 300,000 electronic evidence orders arriving into Ireland every year because so many of the platforms are headquartered here. Will the witnesses outline how the proposed office will be resourced? What will the staffing complement be? What will the technical capacity be? How will it be funded to handle that extraordinary caseload? What assessment has been made of the risk of under-resourcing an authority that is expected to make quasi-judicial decisions at that scale?

The budget for next year for the office has already been established. It was included in the Estimates. The budget for next year is €2.8 million. There is a team at work within the Department preparing, setting things up and identifying the different people who will be required. We would expect that we may have a staff of 30 people initially, but they will be assisted by some experts who we will be taking in on contract. We are making provision such that, in due course, the director will be able to recruit specialist staff who will there employed a full-time basis. That may not be possible in the short term, however.

We recognise that there could be a large number of orders.

It is hard to know how much work is actually involved in processing all of those because we do not have all the details. Some of the estimates would see the body eventually reaching maybe 150 staff in the future, but it will be done on a phased basis.

It is 150 staff, and we are expecting 30 staff next year.

To start off with next year, yes.

Will they be from the Department or are they going to be recruited?

The director will be appointed independently through competition but, initially, the first people there will be from the Department. They will be shifted over and work under the direction of the director.

I am conscious that the Department has a very heavy workload. We are constantly dealing with legislation. Can the Department sustain that level of reduction of staff?

We are getting extra money for more staff in that budget that I mentioned.

It is going to be tricky I would imagine.

Yes, we have to balance out different things. As I said, however, out of the €2.8 million assigned to the Department, €900,000 of that is assigned for staff pay. As was said, we do not know how quickly things will get up, so we do not envisage everybody there for 12 months for the first year, but the answer is "Yes". The Government is very conscious that, basically, we will be the centre of attention for the rest of Europe because nearly every order will be coming into Ireland.

It is estimated at 300,000, potentially.

Yes.

That is initially going to be covered by the Department of justice in terms of the 29 staff.

Yes. They will be assigned to the office of the director, and they will work there full-time.

Will they have to apply or will they be recruited? Where are we going to lose people from in the Department of justice?

I do not know the full details yet. We are busy getting the money and accommodations and things like that.

Yes, very busy I would imagine. This is going to be in law by 18 February 2026.

Yes, but obviously, for the body to legally exist, we have to pass the legislation.

Then we lose 29 staff from the Department of justice. Fair enough. Head 1.4 allows the Minister to assign further functions to this new office by statutory instrument. The Government has already noted that it is likely to take on the European investigation order and other co-operation roles in the future. Why is such a significant expansion of mandate being left to a ministerial regulation rather the Oireachtas oversight? What limits, if any, will apply to prevent this becoming an all-purpose central authority for cross-border surveillance without primary legislative scrutiny?

Our original programme was to do it by statutory instrument for some of the reasons the Deputy mentioned. The fact is that some of the assignments may be able to be done relatively easily but other assignments may require new legislation for the office. On reflection, and subject to the final Government decision, it is more likely that we will remove that provision. For example, we are already working on a general scheme for the European investigation order. That will require primary legislation and it will be able to amend this to provide for that. That is probably the model we will take as we assign things, and the legislation will provide for it.

Mr. Martin is anticipating that the ministerial regulation will be removed.

Yes, I am anticipating that. It is obviously subject to Government decision, but that is the current position.

Those who would support faster cross-border data requests often highlight efficiency, which has been highlighted today. However, we have heard arguments from others that this can potentially affect transparency and accountability. How will the Bill balance the legitimate need to investigate serious crime with the need for democratic oversight, transparency, protection of civil liberties and all those areas?

It is the regulation itself that dictates that. In this Bill, we cannot amend what is in the regulation, but the regulation does have safeguards for that. There was a lot of discussion at Europe about that because, obviously, some people were arguing that this is effectively a domestic investigation. It only affects, say, Belgium, and it is just by chance that they are using a company that is based in Ireland. People argue that there is no other link to it and, therefore, it should be a matter for the Belgian courts to do it, while other people are worried about whether we can trust some other company to do it. That is why the decision was made at European level that there would be that safeguarding role for the enforcing authority if there is an order that does affect a non-domestic. Therefore, if it came from Belgium and involved, for example, an Irish citizen who came here and who was not residing in Belgium, the enforcing authority has to be notified immediately and they have a chance to look at that order and decide that, on the face of it, it does not look like it meets all the human rights requirements. On the structure, however, there are four or five different grounds where an order can be refused and they are set out, but they are the only grounds. An overall ground is if it breaches the European convention and the European charter.

How many orders is Mr. Martin expecting next year?

That is a very good question. The enforcing authority will only receive copies of those orders that come from countries where there is a foreign element in them. If there are orders that are all about residents in another EU state and a crime in another EU state, the enforcing authority will not see that. That will go straight to the service provider with no involvement. If there is an involvement of somebody outside, then it will come. It is very hard, therefore, to know how the breakdown is going to be. I would not like to commit myself. We have had no way of finding out. We have talked to the service providers, and we know the kinds of numbers of queries they already get from law enforcement from around the EU, but we do not have a breakdown about the details of those cases. It is only kind of as we go on that we find out.

God help the 29 staff.

I thank Mr. Martin for the information. My first question ties into how Mr. Martin mentioned human rights. We see across Europe a backsliding in some countries, if we look at Hungary, for example, in relation to women accessing abortion and the potential for that to be a criminal offence in one country and not in another. I did look at, obviously, the e-evidence regulation piece and it mentions double criminality, so I have been trying to understand that a little bit more and how we protect those fundamental rights and human rights. To give an example, if the authorities in Hungary are seeking to prosecute a woman who has tried to procure or has procured an abortion and they want to know what sites or what kinds of conversations or phone calls - I know Internet phone calls are included - or whatever data they are looking for, is there a scenario where Hungary can request from Ireland that type of data to prosecute something that Ireland obviously does not have? We obviously have a stance on it. I am wondering how we then contribute to poor rule of law standards and human rights abuses in other countries.

In theory, the regulation is based on the idea of full faith in credit in the member states' legal systems. It starts off on the basis that it requires a judicial authority to issue this. The primary safeguard is the national law. There are provisions whereby, if there is a foreign element, as I explained, the enforcement authority has the role of stepping in, and there are grounds set out where it could reject and say it should not be done.

When we say foreign, we mean outside of Europe.

No, outside-----

Of the jurisdiction that has been-----

Outside of the jurisdiction. It specifically excludes using European orders for third countries. It has to be from within-----

Its own country. Therefore, effectively, we could give data or facilitate the transfer of data that would see a woman prosecuted for the procurement of an abortion in a country where that is illegal.

I am sorry; I would have to check the regulation. Double criminality means it has to be a crime here as well as-----

That is what I am wondering.

Yes, that is what double criminality-----

So, it has to be a crime here, even if that person is not resident here and they are resident in the country in which the request is coming from.

If they are resident, the mechanics then would depend on the service providers. The enforcement authority would not see it. It would go straight to the service provider.

Okay. I am sorry, but I am just trying to understand the flow, but effectively, if a country requests and that country and that addressee - are they called addressees?

Yes.

If those addressees are placed here, does the function or facilitation of that happen here, and is every request reviewed and assessed before it is transferred or is it an automatic data transfer?

The way the system is proposed to work is that the court in the other member state would do this in order and would send it to the service provider by a special electronic link system that will be specifically for this. If there is a foreign element, it is copied automatically to the enforcement authority. If there is no foreign element and it goes to the service provider, my understanding is that the service provider will look at it and that if it has concerns, it will refer it to the enforcing authority.

The enforcement authority would-----

It could then get involved, yes, but if-----

Not all data requests will come into this body, which will have, say, 150 staff.

Yes, that is correct.

Who gets to decide then? Let us say we are talking about a tech company, a service provider or whatever, but let us say tech companies that are American, are based here and are named as addressees. We have European-wide legislation but we have interplay with other countries. Do the American service providers that are based here make a decision as to whether they facilitate the data, and then do they come to us if they are not sure about that?

Yes. We are talking about a service provider - it could be American owned - that has its establishment in the EU based in Ireland and in respect of which the control of the data is in Ireland. There are some companies-----

Sorry to interrupt. Just so I do not lose this, the control of all this data is already in Ireland, but at some level the tech company whose data is controlled within Ireland can make a decision before Ireland makes a decision as to whether they share that data.

If there is an order from Hungary or any other member state that meets the requirement of the regulation and it refers to a crime allegedly committed in-----

An American tech company will decide as to whether that is-----

It is subject to a court order that is enforceable in Ireland so it is a matter-----

Ireland, therefore, holds the data that could see somebody prosecuted, but the American tech company, just as an example to grab on to, could decide whether to share that based on the regulation. We are trusting, however, that the tech company makes a full assessment of, say, human rights and fundamental rights. It still decides that data controlled in Ireland can be sent for prosecution purposes and it would never necessarily pass the new staff.

Yes, that could happen.

That concerns me as to who is and is not making decisions, whether it is Russia, America or wherever else the companies are held, on data that is controlled in Ireland.

Yes, but, as I said, it depends. It is difficult to go into details, but the issue is that if the company refuses to do that, it is breaching a court order that has direct effect in Ireland. The next stage would be that the enforcing authority would have to initiate the enforcing procedures. It will obviously consider in that context whether it thinks the order is valid, but that would be only if the receiving company refused to comply with the order.

I will come back in in the second round. It is the same with protest, free speech and so on. I am just concerned about all those things in terms of the decision. I thank the witnesses.

I welcome Mr. Martin. As regards the criminal scope of this directive, does it apply to all crime or is it serious crime? I will tell him why I am concerned. We are doing a defamation Bill up in the Seanad Chamber at the moment and there is a question about identifying people who defame other people anonymously on the Internet. Some continental countries do not distinguish between civil and criminal defamation. Is there some threshold for all this?

There is. They have what we would regard as less sensitive data. User data, user identity, is a lower thing. That is available for minor offences as well as for serious offences. For traffic data or content data, however, there is a higher threshold. It has to be a relatively serious offence. It is supposed to be three years or more.

Where is Mr. Martin in the draft Bill?

Under Article 5 of the regulation, "Conditions for issuing a European ... Order", the Senator will see paragraph 3:

A European ... Order to obtain subscriber data or to obtain data requested for the sole purpose of identifying the user ... may be issued for all criminal offences and for the execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia ...

European production orders therefore apply to subscriber data and identifying data for minor offences. For the more major offences, there is a list under Article 5, paragraph 4(a): "for criminal offences punishable in the issuing State by a custodial sentence of a maximum of at least three years". Then there is a list of other offences, but in Irish law they would all be relatively serious offences.

Must there be corresponding offences in Irish law? For instance, in the continental system you can commit a crime and a civil tort at the same time. Will we get to a position where a foreign court can find out things that Irish citizens cannot find out as of right? I cannot identify who defamed me anonymously on social media in Ireland, as things stand, but this seems to open the door to European courts getting that information fairly automatically. Is that right?

Yes, and vice versa - Irish courts will be able to access data held in other countries by service providers on the basis-----

Yes, but it would have to be a crime-----

Yes, it has to be for the purpose of a criminal investigation or criminal proceedings.

What is criminal in Bulgaria may not be criminal in Ireland and vice versa. I will give Mr. Martin an example. Holocaust denial and some forms of hate speech are seriously criminal in Germany but are not criminalised yet or defined in Irish law. I am just a bit surprised that there does not have to be a correspondence of the crime to a crime in Irish law.

There are a list of standard offences that are crimes in all member states, including Ireland. That is in paragraphs (b) and (c). The Senator's colleague mentioned dual criminality and I am just trying to remember where-----

It is in the regulation.

I must be missing something here. Anyway, I am not trying to ask a difficult question. Could Mr. Martin let us know by letter afterwards-----

Yes.

-----what he has in mind for non-correspondence of an offence under a requesting state to Irish criminal law?

I am happy to give the Senator the details, but Ireland does not have any choice because the parameters of the regulation are determined.

It depends. If it is punishable there, an entitlement exists to the information here. Is that what Mr. Martin is saying?

Generally, yes. I will need to double-check this point, though, in respect of if there is a dual criminality, but that will be in the regulation. We have no choice. It is rigid and set and applies to Ireland. I am happy to write to the Senator on this point.

Yes. Had we an opt-in on this regulation or did we-----

It is a package. We do not have an option with the directive. It applies automatically. The other half of the package is the regulation where Ireland has already opted in after its approval by both Houses.

I have a number of questions. Mr. Martin mentioned the body would have a safeguarding role and an enforcing role. How will that work? Will it go to the enforcers first or the safeguarders first?

When an order is issued by the issuing court in another country and comes to Ireland, if the events were committed outside that member state or the person whose data is being sought resides in a state other than that state, that is, if they reside here, then it automatically has to go to the enforcing authority at the same time. I think the enforcing authority then has eight days to check that and decide whether it wants to raise an objection. Under Article 12(1)(d), one of the grounds for a refusal is that "the conduct for which the order has been issued does not constitute an offence under the law of the enforcing State".

That is what I wanted to know.

That is Article 12(1)(d). There does have to be dual criminality. To get over that, there is a list of offences, but Ireland is already a party to the list of all those offences.

Going back to my questions, is any finance for this coming from the EU or is it all funded by us?

No, it is all coming from the State.

Effectively, Ireland is, to an extent, being punished by virtue of our FDI success because we have taken on this role.

I would not like to comment. I think the view of other member states would be that Ireland is raking in tax money from these people and there is enough to fund this. It is not an EU-funded system, but a nationally funded one, so we have to pay for the central authority and the enforcing authority.

Are any charges levied on the extrajurisdictional judicial bodies looking for these orders?

The only provision for charging is that in some states the practice is that the law enforcement agency seeking evidence has to pay the cost of gathering that evidence. There is provision, therefore. I am not saying this is the situation, but as an example, another member state may have a facility whereby, under its law, it can provide a payment to the company for the gathering of that evidence, but there is no provision for Ireland to charge for the number of orders coming into Ireland. We have to bear the full cost.

It was mentioned in the presentation that all these other bodies were looked at and none was seen that would be in a position to take this on. When I heard that, I immediately thought that the Data Protection Commission, which is under the auspices of the Department, would have been ideal for it and there would have been a number of synergies there.

I am not sure it would share the Deputy's view. The Data Protection Commission would see its role as being to protect people from access to data, while this is facilitating access to data.

There is safeguarding and enforcement as well.

That is true, but the Data Protection Commission would not see itself as being a part of the criminal justice system. Some countries are very sensitive. What they would see in the safeguarding role is their court orders being queried by a body in another member state. It has happened in other areas that countries have objected if a body is not seen as being an independent one with quasi-judicial standing. It might give rise to that kind of situation. In any event, the Data Protection Commission did not feel that it was appropriate to it and the Department accepted that.

I have a couple of other questions. I have had experience in dealing with central authorities in other countries and one of the big obstacles is the linguistic one. I refer to dealing with different central authorities under different pieces of EU legislation, the Hague Conventions and so on. It was mentioned that a good number of staff were moving over from the Department of justice to this new body. Will those people be sufficiently linguistically equipped to deal with all the international requests?

The system is based on the assumption that everything will be done, effectively, by the electronic transmission of orders and forms. The regulation has a number of annexes that set out in a kind of set format what orders should do, what is at question and the grounds for objecting to them. In that context, there is an obligation when those other authorities are sending orders and forms that it is done in the language specified by the service providers here, which will presumably be English. The orders will, therefore, have to be translated by the sending authorities into English and that is how they will come here. The Deputy is quite right, though. We may need more linguistic capabilities for interacting with central authorities when issues arise. That is because we must interact with the issuing authority in the other member state, and this may require facilities. The Department does have reasonable resources in this area in the context of interpreters for courts and the migration aspect. Some of the staff are multilingual. I cannot guarantee, though, that we will be able to cope with every language in the EU, but we will have to work that out.

We are quite poor linguistically in Ireland by comparison to some of the other EU member states.

Yes.

Mr. Martin mentioned that, when approving the establishment of this new body, the Government took cognisance of the fact that it was likely to be given further tasks in the criminal justice area. Can Mr. Martin tell us exactly which ones those are?

Except for the European investigation order. The Government has made a decision in principle that Ireland would become a party to the European investigation order. There are a number of other EU and international measures relating to cybercrime and, for example, the European arrest warrant where some countries have issues. The Department is the central authority for mutual assistance at the moment and all requests from foreign courts come into the central authority. Some countries, though, have issues with Government officials being in that loop because they have a very strict divide in their countries between judicial bodies and governing executive bodies and they would prefer not to have civil servants who are subject to direction by the Minister involved in this kind of co-operation with the courts. Effectively, we are co-operating with a court in another member state to give effect to its order. We are, therefore, looking at other bodies that might take over. It may eventually be that many of the mutual assistance roles now assigned in the Department might move to this body. I think it is fair to say that the EU is coming up with numerous other measures that will probably follow this one.

I thank Mr. Martin. I will let him back in. I call Deputy Ward.

To go back to the issue of the costs, was it mentioned that €2.8 million would be needed to run the authority for the year?

Yes.

How many staff did Mr. Martin say were going to be involved?

It is expected that, in the first year, 30 staff will be taken in.

That seems very efficient.

With regard to €2.8 million and 30 staff, including a premises to host them, dealing with 300,000 production orders per year, it seems to be really efficient. Does Mr. Martin think the staff and finances are enough?

In the long term, we do not think it will be enough so we will have to get more in. It is very hard to predict exactly how much will be involved and how much can be done with that number of staff. The expectation is that we could end up with at least 150 staff in the body when it matures.

At this moment in time, we are expecting 300,000-plus production orders per year.

Yes.

Will the 30 members of staff allocated so far be sufficient to deal with 300,000 orders?

Not all those orders will go to the enforcing authority. If they are purely domestic, if it is about an offence committed in a member state by a resident of that member state, it does not come to the enforcing authority. It will go straight to the service provider so the enforcing authority will not have any role. We do not have the breakdown of how many of those-----

Does Mr. Martin have an estimate of how many would get to the authority?

No. We do not. That is one of the things that will govern how many we need in the future.

So it is a case of "learn as you go along" more than anything else.

It is. This is something that has never been tried before. It is the first time where we have direct enforcement of a foreign court order in one member state in another.

When a production order goes to the authority to make that adjudication, how long will it take to make that decision?

The regulation sets out that it has to be done within ten days.

So it is a very quick turnaround.

Yes, very quick.

Am I right in saying that the figure of €2.8 million will be a cost on the Irish Exchequer?

Yes.

We do not know at this stage how many we are going to have to deal with. That is another cost on the Irish Exchequer.

It would be, yes.

I could spend €2.8 million on youth justice systems in this country that to me, would benefit the areas I represent far more than this. Mr. Martin mentioned that there could be a penalty of up to 2% of the annual turnover of one of these companies. Where does that money go to?

It goes to the Exchequer.

So that comes back to the Irish Exchequer.

That comes back. Yes.

What happens then? Have we to roll that back out across Europe or do we reclaim that in the Exchequer?

No, it just comes to the Irish Exchequer.

Would Mr. Martin envisage that there could be a net gain over time?

No. I would not like to give the impression that people imposing fines would have any incentive to impose them. They have to impose fines when people do not comply. I could not really speculate. The purpose of the big fine is not revenue generation but to ensure there is compliance with the system.

Where somebody does not comply and a fine is imposed, that money would go back into the Irish Exchequer.

Yes.

What sort of crimes will the production orders will deal with? Will it be fraud or international organised crime? What examples could Mr. Martin give?

We have seen surveys that show that the investigation of 70% to 80% of all crime now involves e-evidence. It covers every band. The more obvious ones are paedophilia and fraud but everything from theft to murder would normally have some involvement because nearly every facet of somebody's life is recorded somehow, for example, when he or she used the phone, where he or she was or what hotel he or she booked, so it could come up in every type of offence.

We have seen very high-profile cases in this country where mobile phone data has been used to show where a person was at a certain time. If a person was in another country in the EU but the host holding that data was based in Ireland, does it have to apply to Ireland to get this information before this regulation comes in? What way does it work?

There are two avenues. It could approach the service provider, which may voluntarily give it that information, if it is lawful. Normally that would not be admissible in the other court. It would be used for intelligence to further the investigation. If it wanted to get it to use as evidence in the courts, it would normally have to make it a mutual assistance application. It would have to go to a court in its country to get a court order to produce this. It would come to the central authority in Ireland, which would then give it to An Garda Síochána to bring to a court in Ireland and would apply to that court to see if that court would give an order to produce that information. It will go back through that chain to the original investigation.

Is what we are dealing with today expected to put any more pressure on the courts system because the courts system is really under pressure?

The Irish courts will not be involved with new orders coming into Ireland. The District Court will have powers to issue European production orders to get material from other countries but that will be relatively small. It will not be 300,000. We would not see this increasing the pressure on Irish courts.

As the CJICO - the acronym is nearly as long as the title of this new body - will be a public body and the EU justice programme provides financial support for public bodies in the EU to implement new judicial reforms, have we applied for that funding and, if not, why not? Why are we relying on our own Exchequer funds to fund this? I tend to agree with my colleagues here that €2.8 million seems rather conservative. Seeing as the estimate seems to be quite conservative and the number of staff is quite low, does Mr. Martin envisage employing AI, digitalisation and new technologies to minimise staff numbers?

If we can find any funding from the EU, that would be great but I do not think this would be covered because it is not a judicial reform. It is criminal justice. We can certainly-----

Potato, potato.

Well yes, but you know that if you want to get money, you have to be right. We can certainly explore that. The estimate for the first year is the kick off - setting up the body and seeing how much work is actually involved, so we see it increasing in subsequent years but we do not know by how much.

What about digitalisation, AI and other advanced technologies, because processes tend to challenge us at times?

I do not know any of the details so I would just be speculating but it may well use that because of the timeframe to identify. It depends on the volume. I know that in some areas, you might use some kind of programme to identify potential issues that would pop up which would then be looked at by a human.

Seeing that it is brand spanking new and we are setting up what it will be, what it will do and who we will employ, surely we should be grasping with both hands the systems we will adopt to have the most efficient process possible.

It is envisaged that the director will look at the structure and what the director needs for its future. One of the reasons we are not putting too many staff in at the start is because the director has to have a chance to see how it operates and what he needs. That will clarify what kind of structures and IT systems he needs.

So the €2.8 million could be way off the mark and we could end up having a very big bill at a cost to the Exchequer with no return for the Irish taxpayer.

We could see it increasing but not necessarily for 2026 because things will just be starting.

But this is not a two-year project. It is something that will run on and on.

This will run on forever. The cost of running the organisation would be expected to be met from Exchequer funds.

Mr. Martin says that Ireland opted into this regulation. Was it related to Protocol 21?

Yes. It would have been approved by the Government and it would have required a vote in both Houses of the Oireachtas to agree to that.

Does Mr. Martin know if that was under Article 3 or Article 3?

Article 3.

So we signed in at an early stage.

Yes.

When was the Article 3 vote taken?

I am not sure.

We signed it under Article 3 in 2023.

I am not sure about the year. I was not involved in the negotiations. It was just handed to me. We can check that for the Chair and come back to him on the exact date of the vote.

I just have a concern. According to the regulation, this law has to be passed by 18 February.

That is the target. It is a very challenging, not only for us but for other member states.

Does the directive state this as a date?

Yes. The directive requires that we should allow the registration of service providers under the provision at that stage.

There is no chance in hell that this is going to be law by 18 February.

Well, if it is-----

Let me just put it this way. We have a Minister who announces a new law to this committee every time he gets out of bed, it seems. The grand total of Bills passed in the justice portfolio this year, since the new Government came into office, is zero. The one that is most advanced is the one that the Minister does not agree with himself, namely, the Defamation (Amendment) Bill. It was commenced in the previous Dáil. We should be frank in saying the terms of this directive are not going to be met.

I would not like to say that until it happens-----

Right.

-----but, yes, it will be challenging to the meet the date in February.

When Mr. Martin sets out the role and responsibility this body would have, and it deals in particular with criminal investigations, it appears to me that the most natural organisation to have responsibility for this matter would be the Garda. Was that considered?

Yes. It was one of the bodies under consideration. What it would be dealing with here would be judicial orders from other member states. In other member states, the police are very much under the supervision of judicial authorities at every stage. If we use the Garda, I am not sure that they would be acceptable to other member states. Second, the Garda has never been given a role where they would be in a position to impose multimillion fines on a body for not producing the evidence.

When Mr. Martin says it would not be acceptable to other member states, is there a requirement that other member states sign off on who we establish as our centre?

No, not directly, but it will be a matter for the Commission to decide whether we are in line with European jurisprudence on choosing a body for that purpose.

I am sure the Commission would appreciate the fact that we had an option to opt out and, had we taken it, it would probably have derailed the entire process considering the number of the companies involved that are based here. Again, I share a number of the concerns, regardless of what is in the Estimates. That is a piece of string in many respects in terms of the ultimate cost once this body is established. We are setting out to the world here that there are deadlines that we are not going to meet. I would have thought there would be an eagerness to get this body established as quickly as possible. Rather than not enough being put in place, I have a fear that there will be an enormous cost outlay because of the potentially rushed nature of the process. What safeguards are in place in respect of that outworking, because ultimately we will be establishing a new body, potentially as early as February, although that is not likely? Then it will come to the Government with a bill for how much it is going to cost to establish it.

The Department has control of the expenditure. It is responsible. The Department's Accounting Officer, the Secretary General, will be Accounting Officer for this expenditure. The power of the director to spend will be subject to the normal controls for public expenditure.

Has the recruitment process for the director commenced yet?

We just got sanction for the appointment very recently, so I would expect it to be-----

Has a salary been assigned?

Yes. I think it is at assistant secretary level but I would have to confirm that.

Okay. Another potential we saw with the cybersecurity unit is that we could not find a director for a period. Will that process commence in tandem with the legislation being brought forward, as opposed to waiting for a Bill to pass?

We propose that the legislation would envisage the recruitment of the director designate. That has been used in one or two cases so that the recruitment of the director can take place before the legislation is enacted, and then that person automatically becomes the director when it is enacted.

What background is required? Is it law enforcement or IT? What set of skills are being sought from the director?

I do not think the Department has written the job description. I have not seen it yet anyway.

When the new body is in place and it makes decisions, which as we see could be tens of millions in terms of fines, are those decisions appealable?

Yes.

To whom?

The way the system will work is that a process has to be followed. If the person does not appeal against it, it has to be endorsed by the Circuit Court before it takes effect. There is a provision whereby, before that happens, the person who is the subject-----

So it is not a direct fine; the fines have to be endorsed by the Circuit Court.

Yes.

There would not be too many multimillion euro fines dealt with at the Circuit Court.

No, but if there is an appeal, if it is above the jurisdiction of the Circuit Court, it would go to the High Court and the High Court would hold an appeal and decide on the case.

Going back to the earlier question of a fine being imposed - it can be big or small - but that fine needs to be brought to the Circuit Court for endorsement or approval.

Yes. That is the existing model that is used.

That can be contested.

Yes.

Without using any names, we could have some of the companies that Senator Ruane was talking about in the Circuit Court with their teams of barristers challenging a fine.

I am sorry. I did not explain it clearly. I will very quickly run through how the system works. A series of steps have to be taken by the director. There has to be an independent investigation. The person who is being investigated has to get the opportunity to respond. Then the director makes a decision on whether they are guilty of non-compliance and he or she proposes a fine. The person gets a chance to make representations on the fine and then a decision is made about what the fine is and the person is advised. The person is advised that if he or she does not wish to appeal, it will be sent to the Circuit Court for confirmation.

Okay.

That is automatic. If they appeal, and it is a significant fine, that would go to the High Court.

I would not be as loose with a suggestion about AI in any shape or form. That needs a whole other conversation. The fact that we could potentially have big tech making decisions and then AI making the decisions again within the State is a bit concerning. If data that is held in Ireland is requested from the service provider and Ireland owns that data, but it is just given at that point, is there a register held of all data requests coming from other countries for data held in Ireland? Will the legislation provide that the service providers will have to keep a register and that Ireland would at least be aware of all the decisions being made about the data within its control being facilitated to another country?

I think the answer is "No". There is provision for the central authority to share information with the other central authorities, but it does not specifically provide for a register. The idea was that it would keep track of how the system is working in all the member states.

Ireland should be in a position to know what is being done with data within its control, especially if we continue to be a country that allows big high-tech companies to have their tenancy here, as it were. The legislation mentions the regulations also apply to information societies. Will Mr. Martin give an example of an information society?

The definition of service provider includes people who provide information. It is very convoluted. I am sure the Senator saw that. One has to track it back through two or three directives to find a description of an information society. It covers things like social media.

In its briefing note, the Department says it expects 600 organisations to designate addressees.

Up to 600, yes.

Is there a map of that which the committee can have? Is there a list of the ones that are expected to be designated? Is that something we can have for our considerations?

The obvious ones are the big multinationals which the committee would already be aware of. I do not know. I will have to check with my colleagues. I was warned to say "up to 600" because they were not sure exactly which companies it would cover. Under the regulation, a service provider based in Ireland could decide to designate their addressee in another member state. That would be perfectly legitimate. Instead of having them here, everything would be routed through another country.

In terms of the fundamental rights agency, I read that a previous Minister, maybe in the previous Government, said they intended to discuss these changes that would come up in this Bill with the fundamental rights agency. Has the Department had conversations with the fundamental rights agency in relation to human rights and the implications of this general scheme?

No, I do not think the Department specifically has. I expect that would have been discussed at EU level and the fundamental rights associations would have been consulted at that stage. I do not know the details, so I do not want to mislead the committee.

Maybe the committee can request that from the Department. I have a question that leads on from the Cathaoirleach's question around skills. I know only the director has a quasi-judicial role. Is there a standard bar that somebody has to meet to take on that quasi-judicial role? In addition to skills, does that person have to be from the legal profession? Must they have some sort of legal training when they have that quasi-judicial remit?

One of the expectations is that the director will need legal advice and, presumably, legal training. Obviously, it may reach a point where one person cannot make all these decisions. We have made provision that the director can delegate to somebody else. Any decision like that is likely to be contested in court, so we would envisage that if that person does not have legal qualifications, they would get training so they are careful about what procedures they must follow.

I have a final question in relation to other EU legislation that Ireland is party to, whether that be the GDPR or privacy and data protection laws. Is there an assessment done on companies outside of the EU that will be making decisions about data that is held within Europe or Ireland? How do those companies intersect with privacy laws and GDPR laws? How will that be assessed to make sure, when it comes to companies outside of Ireland, that we are still compliant within the EU and Ireland specifically?

I am not sure whether this will answer the Senator's question. The regulation and directive provide that a service provider from outside the EU providing a service within the EU has to register in the EU and that office has to be subject to enforcement proceedings.

The production order has a timeline of eight days from when the request is made to when it is completed. Is that correct?

The enforcement authority has a limited period to examine before it proceeds, yes.

Is that eight days?

It is ten days.

What happens if there is a backlog? Does Ireland risk being fined?

That is why the member state must set up an office capable of identifying. It just continues.

Is there a risk of fines?

If the enforcement authority does not say there are grounds for refusal, the service provider could quite legitimately pass that information back to the enforcement authority.

Is the Irish State at risk of fines if there is a backlog?

Once we have missed the deadline, the case is finished as far as the regulation is concerned. You get your chance to consider it and if you have not done anything, it just continues without the involvement of the enforcement authority.

For example, if somebody from the Polish State made a request to a service provider in Ireland for access to information about somebody engaged in an activity that is in breach of Poland's laws and we do not react to that in ten days, we could lose our oversight remit. Is that correct?

Potentially, yes. It depends how quickly everything else happens. There is a period within which a service provider is supposed to respond. It depends. The service provider might decide that the request is clearly in breach of the grounds for accepting it. It might refer it. Its role is relatively limited on that.

That discretion then falls on whichever tech company is concerned. For example, if somebody involved in LGBT organising in Hungary or Poland is in breach of whatever anti-LGBT laws the country in question is enforcing and that state requests access to the person's Whatsapp data, in circumstances where we do not respond to that request within ten days, is it is then up to the service provider whether to release that information?

Yes, it is a very limited period. That is why the office is so important. We do not know how many of those types of things will arrive.

We do not know how many of those types of things will arrive, but we do know that they will arrive.

Yes. The potential is there. That is why one of the grounds is dual criminality. There is the overarching ground of whether it is compliant with the European charter on human rights.

It says it must refer to the European charter of human rights, not that it has to enforce it.

Yes, but it is grounds for refusal.

Yes, but that is not in the law in its present state. It just has to be referred to, but not necessarily compelled by.

No, it does specifically refer say that. It states:

This Regulation shall not have the effect of modifying the obligation to respect the fundamental rights and legal principles as enshrined in the Charter and in Article 6 TEU, and any obligations applicable to law enforcement authorities or judicial authorities in this respect shall remain unaffected. This Regulation applies without prejudice to fundamental principles, in particular the freedom of expression and information, including the freedom and pluralism of the media, respect for private and family life, the protection of personal data, as well as the right to effective judicial protection.

That is a specific provision in the regulation. Everything in the regulation is subject to that.

Can Mr. Martin tell us about the role of the Circuit Court and the High Court? I am conscious he said to Deputy Brabazon that Irish courts will not be involved. What is the role of the Circuit Court and the High Court?

If the enforcing authority wishes to impose a fine for non-compliance, the process for imposing the fine under principles in Irish law is that the fine is decided by the director but it has to be confirmed by the Circuit Court.

So the courts will be involved.

They will be on confirmation of a fine, yes. There will be quite a limited set of circumstances. That is a role imposed under Irish law. It is not in the regulation and the regulation does not involve any court. There are no court procedures.

I think the actual date by which this needs to become law is 18 August 2026. Is that correct?

Yes.

The regulation applies, with effect, from 18 August and European production orders may be issued from that date.

That is correct, yes.

That is really when we need to have this system all set up.

That is really when things kick off.

A number of 300,000 applications per annum breaks down to 1,000 per day. If they engage anybody's brain for half a minute, it is huge. It really is huge.

Yes.

Thinking about all of those things, I am of the view that if this institution we are setting up will comply with its obligations, it will be vast. If anybody had to make 300,000 decisions a year or 1,000 a decisions a day, unless AI was assisting it and there was virtually no human input into the whole thing, it would be almost impossible to regulate. I am just making that point.

In the Graham Dwyer murder case, the issue of what happened in relation to phone data at a European level came up. I remember when I was Minister, the European Union came up with this brilliant idea that all phone data would have to be scrapped after two years. We objected to that, saying that six years suited us far better in the Department of justice. We pursued it in law and we were effectively told by the European court in Luxembourg to get lost. Later, the same issue was challenged from a human rights perspective. The court struck down the directive that we had been arguing with ourselves. Is it the case that all of this material will have to be erased every two years? Is it the case that every trace of an email will have to be gotten rid of every two years if it is to be amenable to the same regime as phone data is at the moment?

The regulation does not deal with the question of data retention. A European production order only applies to data that is held at the time of the order.

If it is required to be deleted by a European court, what happens?

If it is there on the day, that data has to be preserved for the purposes of the European preservation order because-----

Does this mean that American corporations will have to scrub everything every two years?

No. There is no requirement for that.

I appreciate that is not in the Bill but how can it be that you cannot enquire into Graham Dwyer's phone, and what happened on it, any more after two years but you can enquire-----

It is true that the European Court of Justice has ruled against requirements to retain data in bulk for specified periods and that our law and the EU measure-----

Mr. Justice Charleton wrote an article recently saying this was a serious error on the part of Europe.

The electronic evidence package does not affect the practice and procedures within companies that preserve data for various reasons. For example, if you have a Google email, you consent to records being kept because you want to know what you said two years ago. There is no specific requirement. That is kind of data driven. The Senator is quite right that if phone companies decide they are getting rid of stuff every week, this will not stop it. It will only-----

I will give Mr. Martin an example. If it is the case that the operation of this is governed by the European Convention on Human Rights and its operation has to be subject to that, have I not a right to have all records of my communications scrubbed after two years, regardless of whether I have signed a contract with a phone company or a multimedia platform?

I am not a particular expert in this area but my understanding is that if you give your consent to the keeping of the data for a longer period, it can be kept for a longer period.

In the Dwyer case, the phone companies were required by an EU regulation to scrub everything after two years.

I think the requirement under Irish law that they had to keep the data for two years was scrapped. It was up to the phone companies to decide how long they were going to keep it for their own purposes.

We required it to be kept for six years and the Europeans said that was too long. The result was it was reduced to two years so when the phone was fished out of the lake in Blessington, it was technically illegal to use that data against him expect for the fact it was not done in conscious breach of his rights.

Yes. However, my understanding is that all the data retention requirements we had under Irish law for the purposes of retaining information for the purposes of criminal investigations are all null and void now. There is no legal requirement on a service provider to maintain things for a set period. Most of them retain different types of data for their own purposes. They are free to do that.

They do that to query phone bill rows and things like that.