I welcome Niall and Dermot Eigney, guests of Senator Ollie Crowe, to the Chamber this afternoon. I am sure he will look after them for the rest of day and they will be well fed and watered by the time they finish. I hope they enjoy their visit.

Amendments Nos. 1 and 7 are related and may be discussed together by agreement. Is that agreed? Agreed.

I welcome the Minister to the House. The code of practice, as the Minister is familiar with, is peppered right through this Bill, but I saw an opportunity in the amendment that has not been moved, and in section 3 where there are many references to the code of practice, so it is appropriate to bring it up at this point.

As I said the last time the Minister was here in relation to this Bill, I support the Bill, but it is important to get some clarity on a number of issues. What was particularly interesting, and I drew the Minister's attention to it, was that An Garda Síochána made a detailed submission, as did the Irish Council for Civil Liberties, ICCL, the Law Society, Safeguarding Ireland and the Rape Crisis Network of Ireland. I referenced these during my previous contribution on this Bill. There were recurring themes in those submissions that warranted further examination. I know that the Minster subsequently looked at this Bill and that he became the Minister after the pre-legislative scrutiny was done on this and many adjustments were made.

Most of what is encapsulated in my queries relates to the Data Protection Commission's commentary on the Bill. Interestingly, the Data Protection Commission, DPC, had several points in its submission under the code of practice heading. It noted the centrality of the code, the lawfulness of processing personal data and the purpose of biometric identification in this Bill under the general scheme. The DPC made the point that the code of practice was important. We are effectively signing up to a Bill where we do not know what the code of practice is, but to be fair to the DPC, it pointed out that it was significant and that the Minister and the Department needed time to work out the details about the code of practice.

The DPC stated that the code would need to ensure a clear articulation of the legal basis of processing and reflecting on the statutory footing under the principal Act, and that the circumstances under which An Garda Síochána is allowed to deploy facial recognition technology, FRT, are clear to the public and provide sufficient clarity and legal certainty to prevent the arbitrary use of these technologies. The DPC stated that the lawfulness of the data processing was dependent upon the code contributing to the clarity and foreseeability of the end-to-end effect of the data processing operations, and any room for deviation from standard operating procedures would possibly undermine this. The DPC talked about the effective internal oversight mechanisms governing the deployment of FRT and the identification and definition of the roles and responsibilities of the relevant authorised officers. All of that will be critical in building confidence around the code.

The code is very important and significant. The Minister spoke about it at some length the last time we were here. Clear descriptions relating to the safeguards need to be put in place for the protection of the fundamental rights of individuals, including but not limited to measures to ensure the integrity and confidentiality of the personal data collected and to underline the processing of the staff training and technologies. I know that the Minister is committed to all of this, but I want to put on the record that, having engaged with these four submissions, they raise reasonable, fair and well-articulated concerns.

The DPC went on to say that, given the scale and complexity of the issues in the Bill, it was important that the code of practice would not be regarded as a mere afterthought or formality and that the process of creating the code would not be rushed. To be fair, the DPC is not criticising the Minister. It is just saying that we do not need to rush it. However, we do not want to leave it too long either. I know that the Minister is committed to getting this legislation up, running and enacted, which is important, but in fairness, the DPC says that it is important that it not be rushed.

I ask the Minister to confirm that the code of practice will be laid before both Houses of the Oireachtas when it is prepared. That is an important imperative in terms of oversight by both Houses of the Oireachtas.

I am going to finish by saying that I support the Bill. The code of practice is fundamental. It is a complex thing. No doubt, it will be moved, shaped, amended and improved. When this Bill is reviewed at some time in the future, there will be lessons learned or new thoughts will come about regarding things that we, the legislators, did not envisage.

These submissions are important. I acknowledge the Data Protection Commission, which is committed to keeping an eye on all of this, given its statutory obligation to do so; An Garda Síochána and the then Garda Commissioner, Drew Harris, who made a very detailed submission; the Law Society, the ICCL, Safeguarding Ireland and the Rape Crisis Network of Ireland. They all made very comprehensive and well-thought-out submissions. They came to this legislation with a positive view of strengthening it, not knocking it, and raised their legitimate concerns for the organisations and people they represent.

At the end of the day, this is about a just system that protects everyone proportionately. That is important, too, but there are a lot of sinister and dangerous people in our society and, therefore, all mechanisms of technology and innovation have to be put to the fore as instruments in tackling crime, as well as making our places safer for all. On that point, I wish the Minister well. The issue of the code of practice is really important. Will he give us some feedback in terms of whether the code will come back before the Houses of the Oireachtas?

I wish to inform Senator Collins that we cannot revisit amendment No. 1, but if she wishes to speak on the section, she can.

I will, and I thank the Minister for being here today. Banning the use of technology from states engaged in war crimes and genocide should not even be up for debate. It should just be a given.

We know that An Garda Síochána has, and is probably still using, Israeli surveillance technology. Given Israel's record, this is highly problematic from a national security perspective and because it is supporting a genocidal regime that uses this very technology to target Palestinians. We know that in 2023 An Garda Síochána paid €278,000 to Cognyte, an Israeli surveillance technology company. Cognyte's main product is an investigations analytics platform that uses AI, facial recognition and data aggregation to analyse communications, CCTV, social media and more. The company has a controversial history. Its tools have been used in Indonesia to monitor LGBT and religious minorities, and in Myanmar and South Sudan for mass interception. A Brazilian investigation alleges that a Cognyte system was used under Jair Bolsonaro to track political opponents. Can the Minister guarantee this company will not be used for the provisions in the Bill we are discussing here today?

We also know that An Garda Síochána has paid hundreds of thousands of euro to an Israeli cyberdefence company that has worked with Israeli authorities to target Palestinians during the current genocide in Palestine. That company, Cellebrite, has deep links to Israel's military and intelligence apparatus and has previously been criticised by rights groups for selling its technology to prospective governments. This company has been used by Israel during the current genocide in Gaza to target Palestinians. In 2021 alone, the Garda spent over €200,000 on Cellebrite services. While it is important the Garda has access to technology, including decryption technology required to detect and prosecute serious crimes, alternatives must be found to using companies from states engaged in war crimes, genocide and crimes against humanity.

I do not believe this will be done without enshrining it in law, given the experience to date,. In 2024, the Government banned future purchases of military equipment from Israel due to the actions of the Israeli Government in Gaza. However, this ban did not apply to An Garda Síochána. Acceptance of these amendments would be consistent with the position the Government has taken regarding the purchase of military equipment. It would also be important from a national security perspective, as it makes absolutely no sense to procure this kind of technology from a state that has been hostile to Ireland for standing up against the genocide in Gaza.

I thank Senators Boyhan and Collins for their contributions. Before I respond to them, I want to advise the Seanad that it is my intention to bring forward a minor technical amendment to section 8 of the Bill on Report Stage. This is an amendment to section 43B as it relates to international co-operation, and I think I already advised this House on Second Stage of that intention. The amendment is still being considered but I am told that consultation with the Garda and the Office of the Attorney General is coming to a close, which will allow for its consideration on Report Stage.

First, I will deal with the issues raised by Senator Boyhan where he referred to codes of practice. He correctly identified that codes of practice are a very important part of the legislative framework, particularly in terms of how it operates for An Garda Síochána. The reason he mentioned it in the context of section 3 of the Bill which we are discussing at present is because that is where there is reference to the code of practice, which of course means a code of practice that is declared by me by order, under the existing section 47(4) of the recording devices Act, or indeed, if the Houses enact this legislation, in section 47A. If colleagues have an opportunity to look at section 10 of the Bill, they will see there is a whole new section that will go into the recording devices Act governing a code of practice for Part 6A. As we know, Part 6A is the part that deals with the carrying out of biometric analysis by members of Garda personnel, which is the issue we are looking at.

I agree with Senator Boyhan that it would not be appropriate for me to sit back and wait for the Garda to produce a code of practice. In fact, the legislation is done in such a way that the legislation has to be enacted, and then the code of practice comes after it. It is important that the new section 47A will set out thoroughly what is the procedure for the making and approval of a code of practice in respect of the area of the use of biometric analysis by An Garda Síochána. As colleagues and Senators will see from section 47A, which is at section 10 of this Bill, there is a requirement on the Commissioner to prepare one or more draft codes of practice to provide further detail on the operation of Part 6A, which is the use by the Garda of biometric analysis.

Obviously, once he produces a draft code of practice, it will have to set out the procedures to be followed by members of An Garda Síochána, the parameters for the use of biometric analysis and details about the confidentiality, retention and storage of this important information, and all of this must be done in a manner that ensures it is compliant with obligations under legislation but also under the Constitution and the convention. A draft code of practice may contain different provisions relating to different types of biometric data and analysis, different categories of persons or data, and the circumstances in which biometric data can be used.

Although the Garda Commissioner prepares the code of practice, I am the person who, to use the verb, promulgates it. Before the Commissioner sends it on to me, he is required to assess the impact of the proposed draft code on the human rights of individuals, which I know is of particular concern to Senator Boyhan. The Commissioner has to take into account how any draft code will impact on the human rights of individuals. In doing so, he cannot just discuss it in a room with himself and his senior officers. He has also to engage with me, the Policing Authority, the ombudsman, the Data Protection Commission and the Irish Human Rights and Equality Commission, to which Senator Boyhan referred earlier.

There is a broad procedure put in place as to how the Garda Commissioner must compile the code of practice in respect of biometric analysis, and he has to engage thoroughly with other persons. That is a process that is going to take a bit of time. He then submits the code of practice to me in accordance with subsection (5) of that section and I can, by order, declare that it is a code of practice for the purpose of this Act. Ultimately, it is the elected official - the Minister - who is the person who determines whether it becomes a code of practice. Although I am a member of the Executive, the checks required by this House are also included within subsection (6). There is a requirement there for the draft code of practice to be laid before each House of the Oireachtas, and the order shall not be made until a resolution approving the draft has been passed by each House.

Again, the draft code is prepared by the Commissioner, it then comes to me after he has consulted many others, and I have to approve it. I then have to lay it before the Houses of the Oireachtas, and both the Seanad and the Dáil have ultimate control over whether it comes into effect or not. That is a satisfactory statutory procedure in place which will ensure that all the issues raised by Senator Boyhan will be taken into account.

I will now deal with the issues raised by Senator Collins, whose concern is in respect of issues to do with procurement and the type of products that will be purchased by An Garda Síochána for the purpose of carrying out the biometric analysis. Obviously, it is the case that this is high technology. The Garda will need to purchase the technology used in other jurisdictions, and that is a process it will have to engage in also.

My own view is that procurement is governed by EU rules and national regulations. We have very detailed rules in terms of how public procurement operates, particularly for a contract of this magnitude. We generally do not - and I think it would be inappropriate to do so - put into primary legislation rules that duplicate rules concerning public procurement. It would mean every time we have a piece of legislation - and I am back here later on this evening for the garda powers Bill - regarding any type of further technology or infrastructure availed by An Garda Síochána, that we would include a public procurement provision in respect of that. I do not think it is appropriate. There are mandatory exclusion grounds where a tenderer has been convicted of a series of offences.

That is set out in the public procurement rules. Those rules and regulations provide for a transparent and non-discriminatory process and there are sufficient rules and regulations in place in respect of existing guidelines. Procurement matters generally are not issues that are detailed in primary legislation and I do not think they should be included in the Bill. In the case of any procurement of biometric technologies there are requirements for providers and deployers of AI systems under the AI Act. The Garda Síochána will look to its European counterparts when engaging in the procurement process for best practice in the area.

That is what I wanted to say on section 3. I thank both Senators for their contributions.

I thank the Minister for the clarity which was exactly what I was looking for. We are clear now that this is a draft code of practice which is important. The Minister has set out his role as distinct from that of the Commissioner in preparing the draft. Ultimately, the Minister takes the hit and signs off on it, which is reassuring. It is important that it will come to both Houses for approval.

I note what the Minister said about section 10, the new section 47A. I decided to take it early because I saw there was an opportunity to take it early and get it out of the way. It is good to have clarity at the early stage of our debate today because the code of practice was a particular issue which took up a lot of time in the pre-legislative scrutiny. I was not a member of the previous committee. I know that Senators Ruane and McDowell were and they put a lot of work into the pre-legislative scrutiny. Not everything that they recommended was ultimately incorporated into this legislation. It is important to have clarity on the code of practice procedures, the role and function in relation to the draft of the Garda Commissioner along with his expert staff and advisers, and ultimately the Minister’s role in signing off and accepting if that is an adequate draft of the code as the envisaged in the Bill. I thank him for that clarity on all of those matters.

I thank the Senator for his contribution.

This is a minor technical amendment in section 48A(c) to the definition of biometric analysis to add the word “including”. The definition of biometric analysis is intended to afford gardaí the ability to utilise automated recognition and categorising of physiological or behavioural human features on both known and unknown persons for the purposes listed in the Bill. An added functionality of paragraph (c) is its use in locating a missing person. The addition of the word “including” is intended to make it clear that this is an official purpose rather than the sole purpose of paragraph (c).

I wish to clarify that this is the section in which my amendment was ruled out of order. I just do not want to speak unnecessarily.

The Senator’s amendment No. 5 was ruled out of order. Amendment No. 3 is in order.

Amendment No. 3 is not in this grouping, is it?

No, we are only discussing amendment No. 2 and will then move to amendment No. 3. The Senator’s amendment No. 5 in this section has been ruled out of order.

I will wait until we are speaking on the section so.

I move amendment No. 3:

In page 5, to delete line 33.

As we know, this Bill will provide for the use of AI facial recognition systems by An Garda Síochána. I believe the Government has gone about this in a fairly interesting way, using a novel term of "biometric analysis" to define the systems gardaí will be using. However, even though the Government is using that term, the definition provided in the Bill is effectively the same as biometric identification, as described in the EU AI Act. Our amendment deletes line 33 which states that biometric analysis, the novel term which is not used elsewhere within the EU AI Act to describe the technologies that will be employed by the Garda throughout the Bill, does not include biometric identification. Even if the Government might wish for this to be the case, it is hard to see how it will be.

Recital 17 of the EU AI Act is very clear. It states:

The notion of ‘remote biometric identification system’... should be defined functionally, as an AI system intended for the identification of natural persons without their active involvement, typically at a distance, through the comparison of a person’s biometric data with the biometric data contained in a reference database, irrespectively of the particular technology, processes or types of biometric data used.

This is a very wide-ranging definition. It is difficult to understand how biometric analysis does not include biometric identification as defined by the AI Act. Therefore, we propose to delete the lines that assert that they are not the same thing with particular regard to paragraphs (b) and (c) of the definition. The definition of "biometric analysis" in paragraph (c) seems to be clearly biometric identification. It states that biometric analysis means "the automated recognition" in relation to a particular identified individual. For what purpose would gardaí use technology other than to identify the person under this definition?

As much as the Government might want to consider this as biometric analysis, inevitably identification will be happening through the use of these technologies, which puts the use of these technologies in a high-risk category under the AI Act, for which a wide range of safeguards are outlined. What impact will calling these systems by another name have for our compliance with those safeguards? Does this allow us to circumvent the protections outlined in the AI Act?

Interestingly, in Recital 40 Ireland has a carve-out due to the common travel area for the purposes of law enforcement. It is not bound by the rules in Article 5 around the prohibited AI practices in Article 26.10 in relation to seeking approval from a judicial authority for the use of biometric identification in a criminal investigation. Article 26.10 contains many other safeguards regarding the use of biometric technologies. There is an important question that the Minister needs to clarify on this. While we are not bound by these safeguards, are we opting in to those safeguards and if we are not, why not?

As I read it, that carve-out exists because of the common travel area and because of the Good Friday Agreement but I do not understand why and how that decision was made. The procedures described in the Bill are not comprehensive and our subsequent amendments will speak to concerns about how this technology will be implemented.

If we do not opt in to the protections in the AI Act, there is a significant risk that Ireland will become an outlier in Europe where the use of these sorts of surveillance technologies can be trialled. It is a fairly chilling prospect that this country would become a testing ground for the application of biometric systems in criminal investigations and it raises serious questions about the implications of that application on the rights and liberties of citizens and the people who are living here.

Another important point to be made here is that we need to be very careful in describing the use of biometric data inaccurately. We have been here before. The Department of Social Protection was fined by the Data Protection Commission last year over the use of biometric data linked to the public services card. The use of biometric data in that instance was deemed to not meet the requirements of data protection law as required by GDPR. In this Bill, by creating a novel term in "biometric analysis", which I do not understand, we are using a type of biometric analysis but it is clearly biometric identification and it seems to be trying to move around the acknowledgement of that and diverging from the terminology used in the AI Act. We are concerned that there may be issues regarding this Bill’s compliance in the future with GDPR.

The European Data Protection Board has previously issued guidelines on the use of facial recognition technology in the area of law enforcement.

The guidelines outlined the specific scenario examining remote processing of biometric data in public spaces for identification purposes and found that such use would constitute a disproportionate interference with the data subject's rights under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Has the Minister considered these legal implications? The crux of it is that this Bill refers to biometric analysis, but what is clearly outlined is biometric identification. That does not align with the EU's AI Act, which clearly names it as biometric identification.

I thank the Senator for her amendment and her contribution. Her amendment seeks to make a minor but significant change to section 43A and, in particular, the definition of "biometric analysis". The section we are discussing here seeks to put section 43A into the Act. That is the first section in the new Part that is entitled "Carrying out of biometric analysis by members of Garda personnel". Obviously, it is appropriate that we define what biometric analysis is. Senator Ruane's amendment recognises that the first part of the biometric analysis sets out in three paragraphs a definition of what it is, but then the part that she wants to delete in this amendment is line 33, which states: "but does not include biometric identification;". In the legislation over the page, we then include a definition of "biometric identification". If this amendment went in, we would still find ourselves left with the issue of the definition of "biometric identification".

Let me try to deal with it in layman's terms, or the only terms I understand in respect of this issue. Facial recognition technology comes under two headings: biometric analysis and biometric identification. In respect of both of them, we can have either retrospective biometric analysis or identification, or live biometric analysis or identification. What we are talking about in this legislation is the introduction of retrospective biometric analysis. I intend in future, and I am sure it will be more contentious than this, to bring forward legislation that will seek to introduce biometric identification and, indeed, live biometric identification and analysis. However, to describe what biometric analysis is, the best thing is to use an example from An Garda Síochána and the work it is doing, because that is the purpose of the legislation here. If the Garda has a video and video images of a person whom it believes committed a criminal offence, and it has the person on the screen, biometric analysis is going to assist the Garda in figuring out whether that person on the screen is the same person who is on a video later on entering a house in some other area or on a street elsewhere. You do not have a database of individuals against whom you are checking to see if that individual is identifiable on the database. Instead, biometric analysis is simply comparing the images of one person on one screen with another person on another screen. The benefit of it is that it will be able to tell gardaí that the person who is on O'Connell Street there is the same person who is getting off a bus in Rathmines half an hour later. They do not know who the person is, but the analysis facilitates them in identifying the movements of that person.

If we look at the definition of "biometric analysis", really it is in paragraph (b) of section 43A that we get the specific definition of what I am stating there:

in relation to a particular, but unidentified, individual, the automated recognition and categorising of physical, physiological or behavioural human features by the use of specific technical processing of documents obtained by An Garda Síochána in the course of an investigation, in respect of instances of the particular unidentified individual ...

To put it in the simplest terms, biometric analysis is trying to identify unidentified individuals and figure out whether that person there is the same as the person on the other screen. That is what analysis is. It is also going to be used, however, for the purpose of a missing person. In that instance, you will have the identity of a missing person, somebody will be able to identify a photograph of the child, and you can do biometric analysis by checking different screens to see if that child comes up.

"Biometric identification" is defined in this legislation as follows:

"‘biometric identification’ means, in relation to an individual, the automated recognition of physical, physiological or behavioural human features for the purpose of ascertaining, or attempting to ascertain, the identity of an individual by comparing biometric data of the individual to biometric data stored in a database of one or more named individuals ...

The really important distinction between analysis and identification is that when it comes to identification, you are checking somebody against a database. To use the example of the Garda station, if biometric identification is introduced by the Oireachtas in due course, a garda looking at an individual on-screen will be able to check that individual's image - face - against a database of individuals. That is not what this legislation is doing. This legislation is analysis, comparing whether that unidentified person is the same as another unidentified person later on.

The amendment by Senator Ruane proposes to remove the exclusion of biometric identification from the definition of "biometric analysis". Drafting conventions sometimes require that a term be defined relative to another definition. In this instance, biometric analysis is everything listed in subsections (a) to (c) but it is also, for the avoidance of doubt, not biometric identification. It is of benefit to those who are opposed to biometric identification to know that biometric identification is not included in this legislation. There is no doubt about that. As I say, I will be coming back at another date seeking to introduce it.

I note that this proposal to remove reference to biometric identification is not accompanied by an amendment that deletes the definition of "biometric identification". This would confuse the Bill's intention and bring ambiguity to the Garda's powers vis-à-vis biometric technologies. The amendment would seem to allow for the possibility for Garda use of biometric identification without any of the accompanying safeguards and oversight. Biometric identification will be provided for in another Bill. I hope to publish its general scheme in the coming months.

With the greatest of respect to Senator Ruane, I do not think the amendment serves any purpose. What would happen is that we would have a definition of "biometric analysis" and we would still have within the legislation a definition of "biometric identification". I would have thought, if it was being interpreted by a court, they would say there was obviously some purpose for including a definition of "biometric identification". In fact, the only reason is to exclude it from the definition of "biometric analysis".

Senator Ruane also asked why I was not using the definition of "biometric identification" as set out in the AI Act. As I said, biometric identification is defined in this Bill as a type of biometric processing that is not covered by biometric analysis. The definition provides that biometric identification is the comparison of biometric data of an individual against a database of images. The scope of what is being provided for in terms of biometric identification will be clearer in the second Bill. My understanding is that we opted into the AI Act, certainly the policing sections of it. I am fairly satisfied that there is no inconsistency between what is in this legislation and what is in the AI Act. When it comes to our obligations under the GDPR, I believe this legislation is completely compliant with it as well. As I indicated earlier to Senator Boyhan, there is a procedure set out in section 10 of the Bill for the preparation of codes of practice. That code of practice requires the Garda Commissioner, before it is approved by me, to consult with the Irish Human Rights and Equality Commission and the Data Protection Commission. I am very satisfied that when it comes to the code of practice and, indeed, the primary legislation, there would be complete compliance with GDPR data retention requirements and any human rights obligations.

I thank the Minister. After all the time in pre-legislative scrutiny and on the AI committee spent exploring what is and is not identification, facial recognition and so on, it is really difficult to understand how this Bill is about analysis when it carves out that one sentence saying it is not identification.

If two CCTV clips are being compared, where are those clips being stored? The analysis still results in identification. It is hard to see how analysis, which will exist in this legislation, will not ultimately result in identification.

It is not that I am trying to get a carve-out here. Biometric identification is something I have an issue with but I also have an issue with how this Bill is written. I have an issue with how the rest of the definition is written when we compare it with the AI Act. The AI Act calls it identification. The Minister's definition of “biometric analysis” is called "biometric identification" in the AI Act. For me, this is about making sure we call this what it is, regardless of whether we have different views on how it should be used.

I refer to Recital 40, in particular, in relation to the purposes of law enforcement and the special carve-out Ireland seems to have in relation to biometric analysis and its definition in terms of "identification". The Minister has said he will be bringing forward legislation in future. Are we saying, though, that it is not bound by the rules of Article 5 in respect of this legislation around prohibited AI practices? When the Minister tells me about biometric analysis, it sounds exactly like biometric identification. A database and the ability to use a comparison to identify a person exist in both scenarios. In a situation where somebody is missing or in a crime-related context, that analysis still results in biometric identification. I am not certain that I agree with biometric identification and have concerns about it but my concern is that leaving this sentence in this legislation is actually misleading when we look at the rest of the definition in comparison to the EU AI Act.

I agree with the concerns raised in this regard. With respect to the Minister, the recital of the AI Act talks about the "identification of natural persons, without their ... involvement ... through the comparison of a person’s biometric data with the biometric data contained in a reference database". The Minister pointed out the language that has been added into the legislation, which probably does need to be amended on Report Stage, is relation to biometric identification. The Minister seems to be adding in the fact of a person being named in the context of the definition. If individuals are not named, then it is not identification. The Minister himself, though, used the words "to identify unidentified individuals" and assist in "identifying” multiple times during his own speech. What is being done is identifying. If there is an image of somebody and a video of somebody and it is said that is the same person in both instances, then they are being identified. That is biometric identification. The fact that it is not known whether the person's name is Stephen, John, Tony or whatever else might be is a little bit by the by, because this aspect is concerned with biometric identification and not named identification. The attempt to narrow down the definition of “biometric identification”, to say it is only applicable in the cases of named individuals and thereby leave this whole world open for a completely newly invented concept of biometric analysis does not fly. It is not consistent with what is happening in the AI Act and in the law.

It reminds me, very vividly, of an attempt previously by a Department to try to literally redefine its way out of a breach of European law. That was the Department of Social Protection. I remember having a discussion with the then Minister, Regina Doherty, where it was said that we simply had different understandings of what biometric meant. The problem, though, was that her definition and understanding was wrong and was found to be wrong by the Data Protection Commissioner. The Department of Social Protection at that time was keen to claim that the thing it was doing, which was clearly biometric, was not biometric. We pointed out that the proposed public service card contained biometric information and the Data Protection Commissioner confirmed it was biometric information later. The company employed to fulfil the contract to make these public service cards was originally named Biometric Card Services. The company renamed itself when it got the State contract to Security Card Concepts. The idea was to literally rename the company, whose title accidentally mentioned that what it was doing was biometric, as Security Card Concepts.

When I look at biometric analysis, a little bit of the Security Card Concepts situation comes to mind. It sounds a little bit like the same thing. We know what biometric identification is. It comes with the proper weight and precedent of the law and has been identified as an area with regulations attached internationally. The Government, therefore, has decided to put a new thing in the mix called “biometric analysis”, which means something slightly different and where it can wing it and do things its own way. It is a weak ploy to literally rename something. It does not stand up in this case and did not stand up for the Department of social protection when it tried to do this. It is a distraction from the proper discussion we should be able to have around biometric identification. All the activities the Minister has described are biometric identification. This is a distraction as well from having a discussion of how we can put safeguards in place in relation to this concept, how to do it responsibly, how we can address it in the best and most appropriate way and how we can bring ourselves into the closest alignment with best international practice.

The Minister is now saying we will talk about biometric identification at another time but that this legislation is about biometric analysis. An attempt is being made to almost try to exclude all the relevant information from the debate and discussion on biometric identification. I plead with the Minister for honesty here and a reflection of the fact that biometric analysis is effectively biometric identification. Let us not try to create an easy opt-out. Let us, instead, have a meaningful discussion on biometric identification and everything that comes with it.

I thank both Senators for their contributions. When it comes to the application of this legislation, if it is enacted, or its interpretation by a court, both circumstances will require a court or a garda applying it to consider the definitions contained within this legislation. The court and the garda will not be going to a definition of “biometric analysis” or “biometric identification” in the AI Act. For the purpose of this legislation, it is the definition of “biometric analysis” set out here.

The part of the legislation we are discussing here is called the carrying out of biometric analysis by members of the Garda Síochána. What is clear from a plain reading of this legislation, if enacted, is that it establishes a distinction between "biometric analysis" and "biometric identification". Irrespective of what the AI Act says, here we are establishing a distinction between the two and only biometric analysis is permitted in this legislation.

The real difference between biometric analysis and biometric identification is that biometric identification requires the assistance of a database of images. That is not needed for biometric analysis. To go back to the example I gave earlier, biometric analysis arises when a garda is looking, for example, at an incident in the city centre and he sees an image of a person who he does not know and who was involved in the commission of a serious assault or other offence. The garda will then be able to use biometric analysis to determine whether that person is the same as the person who got off a bus in Rathmines 45 minutes later. The Garda will still not know the identity of the person. This is what biometric analysis is. It is about seeing whether one image of a person is the same as another image of a person elsewhere.

It is no doubt the case that if a garda sees the person, it is the case that they are the same person and it is possible to identify that the person getting off the bus goes into a house, that will lead the Garda and the investigations to the house. Ultimately, it will be possible to identify the individual. This is, however, completely different to the process of biometric identification, where, to use the example I gave, a garda is looking at an image, sees a face, checks that face against a database and the database comes up with the name of whoever the individual is. That is what biometric identification is in this legislation. It is not covered by this legislation, but the former example I gave of biometric analysis is covered by the legislation.

We also seem to have some sort of different understanding of what identification is. Identification is identification. Whether you are comparing one video camera to another CCTV feed or picking out someone getting off a bus and going into a house, it is used for identification. Biometric identification is not understood to be that you just compare something with a name in a database. Identification also follows people around through facial recognition and that is a database, even if it is on a slightly behind clock. Biometric identification is not just a list of names you have on your system and you compare them to see if a person happens to be a particular named person. Biometric identification is the result of identification. It is probably later in the Bill in another section, but the required rank of garda is not stated in the context of going back to Article 26.10, which Ireland seems to have a carve-out from, in relation to seeking approval from a judicial authority for the use of biometric identification. There is also another part of the Bill that says a garda can just ask a fellow garda - another human - to look at this and ask whether they think someone is a particular person. That seems to be standard enough, which is not appropriate. I do not mean to be insulting in any shape or form but I do not know if the Minister, when he is speaking about and explaining biometric analysis, truly, when he breaks it down, does not see how that this is biometric identification, given that the end result is identification.

It is biometric.

Yes, but it is biometric identification. It is not biometric analysis. It is just biometric identification. What if you remove the identification piece, whether it is against a database or a live CCTV system where you are comparing one street with the next one to see where someone is moving and tracking that person to identify them? If you remove the end result of identification, then what is analysis and what is its purpose? It does not have any. It does not exist as its own thing. It only exists with the weight of the end result of identification, which makes a biometric identification.

All we are really asking is not to shut down the conversation on biometric but to have it in the right place and to not leave us open. We are also asking that the Government be transparent about the fears around it and the fact Ireland has this carve-out based on the common travel area and on stuff from the Good Friday Agreement. Ireland is the hub of big tech in Europe, and now we have this carve-out. That is really concerning in terms of what vested interests there are in Ireland being the place where there is a carve-out in how we protect people from the use of biometric analysis and keep that in check. The worst-case scenario is that we have that carve-out in an Ireland that is completely swamped with big tech. Why is that? What if I was to be really paranoid about it? Why do we have that carve-out? In relation to Recital 40, I still do not understand why, due to the common travel area, we have carve-outs in how we define "biometric identification". I plead with the Minister to see the logic that, when you break it down, analysis is identification. We are just asking him to name it for what it is so that we can have the conversation and make sure that the protections are in place for people.

I might be the only person in this House who suffers from a condition called parliamentary masochism. I dragged myself away from committee room 4 where we had harpists performing reels and came up here to be entertained by the Garda Síochána (Recording Devices) (Amendment) Bill 2025. I came in at a very good time because I am addled by the biometric identification and biometric analysis and I am finding it curiously entertaining and informative. I ask the Minister if he could throw some light on an aspect of it. He was talking about biometric identification. This is a process, I gather, whereby gardaí will be able to look at a database of images, presumably facial images, from wherever. I was wondering where these images will come from. Will they be Europol images or from Interpol? Will we have access to the databases of so-called bad actors on the other side of Europe? Will the Minister enlighten us as to where the bank of image data that will be used will come from?

I thank the Minister for enduring my really profound ignorance on this subject, but it is becoming more and more entertaining by the minute.

Again, this is just an appeal for honesty in this. When the Minister spoke, he used the word "identify" multiple times. He spoke of identifying "unidentified individuals" and assisting in "identifying". What is happening is identification.

Ultimately.

What is happening is we are saying we believe this person in one image and this person in a second image are the same. Where are these two images stored? They are stored in forms of public databases. It does not matter that it is traffic footage. It does not matter what form of database. I go back to the Recital 17 of the Act, which refers to "the comparison of a person’s biometric data with the biometric data contained in a reference database, irrespectively of the ... technology, processes or types of biometric data used." Thus, it is not a matter of saying this is the database we compare them with that has the names in it and if we compare it with other databases, it does not count. That is effectively what the Minister is saying. Consider the data we store in relation to our transport system or the data stored from public CCTV cameras. Those are databases. Once you are comparing images with other images that are stored, you are comparing with databases.

Then there is this suggestion we will have one form of database that is the designated database with names in it and if we compare it with that, it is going to be biometric identification. Names are not necessarily part of biometric data. They are an extra bit. That is like saying we have a database of people with red hats. It is literally picking one factor, which is not a biometric factor, and saying that is what will determine that it is biometric identification. The Government is picking a non-biometric factor and saying that is biometric identification and otherwise it is just biometric analysis. Biometric identification is literally the biometrics, including the face, the body and the movement. These are the things you are looking at when you are looking to identify someone and that is what is happening when you compare an image from one form of data storage place with another data storage place.

With respect, if there really was a need for this separate category of biometric analysis that had to go so far as to say it was not biometric analysis and had to be tagged on at the end in an attempt to narrow that down, why on earth would the AI Act not say biometric analysis was only against a particular database that had named individuals? Why is that not in the AI Act? Why is there not a separate "biometric analysis" definition in the EU Act?

It has been a long process. There was a lot of discussion. Why is it unique to Ireland that we have to invent a brand new security concept called "biometric analysis" that is going to be just us doing our own thing? We also seek to lower the bar for what biometric identification is. It will not just be bad for us, but for Europe, if we try to create a lower, worse, narrower and inaccurate definition of "biometric identification" and stick it in a Bill literally so that we can point at it and say we are not doing that thing. It would be absurd if it was not so damaging, not just to ourselves, but to others across Europe.

I have another point. The Minister mentioned the data protection piece and in response to that I note the guidelines of the European Data Protection Board.

There may be carve-outs. There is extreme concern in relation to how those carve-outs seem to be applied and employed in relation to this Act and the AI Act. It still applies under GDPR. The European Data Protection Board previously issued guidelines on the use of facial recognition technology in the area of law enforcement. In those guidelines, it explicitly outlined a scenario very similar to those scenarios the Minister has been playing out, of people jumping on the bus, running away and going through the town and we are finding them. In these specific scenarios that involve remote processing of biometric data in public spaces for identification purposes, it found that such use would constitute a disproportionate interference with the data subject's rights under Article 7 and Article 8 of the Charter of Fundamental Rights of the EU.

The Minister identified and looked at the implications for GDPR in relation to that. Is this weird fudge of pretending it is not biometric identification also designed to get around the GDPR piece and the European Data Protection Board's clear messaging in relation to how facial recognition should and should not be used in public spaces?

I had occasion to visit Anglesea St. Garda station in Cork with the Minister, Deputy O'Callaghan, on a visit to Cork recently. Without wishing to divulge anything I should not divulge, we saw a room in which the surveillance cameras in various locations in the city were being monitored by An Garda Síochána. It was a hugely impressive operation. This is video surveillance at its best to keep our communities safe.

I am open to correction on this, but there may be an inference in what is being said regarding biometric analysis of an effort to hoodwink people by saying that biometric analysis includes biometric identification. In my view, the distinction made between the two is clear in what is being proposed, having a separate reference to the biometric identification as opposed to the biometric analysis, along the lines of what has been explained by the Minister. Specifically in relation to amendment No. 3, this is something that was suggested by the Minister. If what has been suggested, namely the deletion of the line, was to be voted through here today, there would be no point whatsoever in having a reference to a specific reference or definition of biometric identification. If that amendment was being proposed, it should have been the case that the deletion of the subsequent reference on page 6 to biometric identification should also have been suggested, and that has not been done. If we were to vote through what is being proposed today, of which I am not in favour, the whole thing would be incomplete because the reference to biometric identification and the definition would remain on page 6 of the Bill.

I thank all Senators for their contributions. It is important to point out that the purpose of this legislation is to protect people who are victims of crime and to provide An Garda Síochána with tools to investigate serious crimes. One of the crimes that would be most relevant to the biometric analysis when it is enacted is child sexual abuse material which is on video, because it will enable gardaí to use the tools of biometric analysis to see whether or not a child who has been sexually abused in one imagery is the same as a child in another. We need to bring it back to the practical benefits of this legislation in terms of protecting people who are victims. The alternative to it is that gardaí have to go through reams and endless hours of images to see is whether the same child is in that video as is seen subsequently.

I have spoken endlessly about identification and analysis. The important thing is the word "biometric". Biometric analysis can, I agree, ultimately lead to the identification of a person, but it does not lead to the immediate identification. Biometric identification does because it is done against a database. To use Senator Conway's example, an example would be images of people wanted for serious criminal offences of whom there are images on an Interpol or Europol site. When it comes to biometric identification, if they are on a database their names will come up and they can be arrested by the Garda on arrival into Dublin Airport as they are wanted for a serious offence elsewhere. That is biometric identification. However, with biometric analysis there is not a database.

Sometimes the criticism is that we just adopt everything that is happening in Europe. When it comes to domestic Irish legislation we are perfectly entitled to use our own definitions and our own interpretations or interpretation and that is what has been done in this legislation. A clear definition of biometric analysis is being set out. There is also a definition, separately, of biometric identification, saying it will not apply here. That is the one with the database. However, if we go for this amendment we will simply have a definition, as Senator Kelleher said, of biometric analysis and biometric identification, with no reference to the latter in the legislation.

It is important to say that when we talk about safety, serious crime or child sexual abuse, often it can be presented in this way that everybody does not care about that because you want to make sure that a piece of legislation is doing what it says it is doing. Everyone cares about the safety of people, about victims and about reducing victimisation. It is important to say that. When somebody analyses a piece of legislation to ensure it is good legislation, it is not to reduce that concern. We have to remember that people are sometimes misidentified by biometric data analysis. If a person's biometric analysis is being compared, this cannot be analysis unless it is being compared against other biometric analysis because then what are you comparing? A face is not compared against a name; that is not a comparison. As Senator Higgins said, a name is not biometric data. Biometric analysis has to be biometric analysis of biometric data against biometric data. They are like for like, they are a comparison - an analysis of the two that results in identification. It is not to weaken the safety or to create a sense of a lack of safety or that we do not want to ensure there is a reduction in crime or victimisation; it is to make sure that when legislation is created, it is clear and does what it is meant to do and does not disproportionately impact people in other ways. Surveillance creeps in. We can start off with the stuff that can get people emotional, and understandably so, around the protection of children or other people. That can be a response in which we create legislation. I understand the intent of that. I understand the reason people might believe this is for the protection of people.

Fair enough, the other amendment would not make sense but actually the purpose of this amendment was to understand what people's understanding of biometric information was. On Report Stage, all amendments will line up, but we are only on Committee Stage. It is helpful to have that understanding before we start defining things. To remove the item that says this is not biometric identification, does that mean if I am a barrister, which I am not, and this is probably something the Minister has considered, and I go to court with a piece of legislation that says "This is not biometric identification," and a case is being made against me that I have been identified through biometric analysis, does the law not create a scenario for me where my identification has been obtained in ways that are not actually captured in legislation? Do we end up actually risking the integrity of the cases we are speaking about today where serious crime is happening? What if someone says their biometric analysis was misused to identify them because the legislation said this is not biometric identification? Actually, I would say that making sure we are actually naming it for what it is gives strength to those situations where someone is identified through biometric identification, because we are not creating a get-out clause in the legislation that that is not what it is.

I accept that the removal of that phrase, on its own, would not be sufficient in terms of the layout of the Bill. I leave the discussion probably even more convinced than I was when I came in that "biometric analysis" is biometric identification. I will return to that in more appropriate amendments at another stage.

The analogy of a tool was used. As Senator Ruane has said, we all want the right tools to be in place so that we can do the work of identifying, of bringing justice to place, etc. However, what we have here is a tool which has lots of question marks about biometric identification. There has been a rigorous process of debate to figure out biometric identification and what the safeguards are. When you use a tool, is it a tool you need safety equipment with? Is it a tool that requires preparation? Is it a tool that should be deployed in this way or that way? Every aspect of how you use this tool in an appropriate way has been collectively worked on and thought about at European level. We may not like everything about what has come out of that process, and others may not like it, but the point is that there has been a rigorous and long collective process of developing the tool, and of talking about that tool, what the safeguards are and how you use the tool. As we know, the use of any tool, however useful, can have inadvertent consequences. For example, it can cause injury and can cause damage.

Now we have a Bill that says we are inventing a brand new tool. We have skipped the process, skipped all that EU discussion and skipped the AI Act. We have our own tool that we have invented here. It is not the tool we have surrounded with safeguards and hassle-filled safety equipment to determine how biometric identification will be used. It is not that; it is another tool that we can use how we like. That is dangerous and it has negative consequences for everybody. It has negative consequences in terms of how it might be used. It has negative consequences because it separates us from all of those proper and appropriate safeguards of the law. It has negative consequences even when it comes, as Senator Ruane has outlined, to the courts because it is totally ambiguous.

We absolutely need to check the invented definition of "biometric identification" that has been put into this Bill. It separates itself from identifications because the AI Act provides that biometric identification is "comparison of ... biometric data with the biometric data". That is what biometric identification is. It is not the comparison of biometric data with a list of names; for instance, biometric data compared with where you went to school or biometric data compared with any other factor. It is biometric data compared with biometric data - those two being put together.

As for that bank of impressive cameras that Senator Kelleher saw recording in Cork, were they instantly deleting or were they recording? Can they go an hour back? Can they go two hours back? Can they go three hours back? Of course they can, because they are there for public safety, and they are databases. Unless that is a glide feed with no recording, it is a database and it is one of the databases that the other images will be compared against. The Minister is comparing biometric information with biometric information in another database and that is biometric identification. That is what it is. Straight up, it is not a different thing. This thing of introducing the names just does not stand up.

The Minister also failed to answer the concerns as stated by the European Data Protection Board in its clear messaging in relation to the guideline on the use of facial recognition technology in exactly those scenarios the Minister outlined in remote processing in public spaces for identification purposes. Has the Minister considered the legal implications in relation to those guidelines from the European Data Protection Board? Does the Minister believe that naming it as "analysis" rather than as "identification" is getting around the ruling they made in relation to the exact scenarios he described? Is that the Minister's understanding? Does the Minister believe that he would be able to say it was analysis, not identification, in relation to the breaches under Article 7 and Article 8 that they identified?

I have answered all the issues previously. I have indicated I am satisfied it complies with the GDPR and with data protection.

I will withdraw my amendment but reserve the right to resubmit on Report Stage.

I move amendment No. 4:

In page 6, after line 40, to insert the following:

"(3A) A member of An Garda Síochána shall not deploy biometric analysis unless authorised in advance by a member of An Garda Síochána not below the rank of Chief Superintendent, who shall record in writing the grounds of necessity and proportionality for such deployment.".

This amendment seeks to ensure that there are safeguards in terms of how this technology is used and that there is no overreach by ensuring the deployment of biometric analysis must be authorised in advance by a member of An Garda Síochána not below the rank of superintendent. We know that Gardaí have faced disciplinary procedures for the misuse of the PULSE system in the past, including the horrendous case in which a former garda was jailed in July for inciting strangers to rape a colleague. That individual pleaded guilty to the unauthorised disclosure of Garda PULSE personal data of 14 individuals. While it is important to say that these misuses related to a very small minority within An Garda Síochána, the experience of that misuse of the PULSE system reinforces the need to ensure proper protections are in place to ensure that these technologies are only used where appropriate, properly authorised and necessary for the investigation of serious crimes. I believe it is appropriate to set at least the level of superintendent to be able to authorise this.

I thank the Senator for her amendment and her contribution. I discussed this in the Dáil with Deputy Carthy. I cannot accept it.

When you look at what biometric analysis will be doing, it is a tool that will assist the Garda in sorting and filtering data so that a human reviewer can narrow down avenues of investigation. That is the purpose of it - to speed up the process in order to protect victims who could be in immediate danger. If we take an example of a child sexual abuse investigation where there would be thousands of images over which biometric analysis could be performed, if the approach in the Senator's amendment were to be adopted it would require biometric analysis of each image to be approved by a chief superintendent. It would be untenable for the gardaí, in terms of the work they are doing and the tools they are availing of, to get the permission of a superintendent for each image. They would lose valuable time seeking authorisations. They would lose time identifying vulnerable victims and waste valuable Garda time. It makes no operational sense to proceed in this manner proposed by the amendment.

Identifiable persons will be responsible not only for reviewing the footage or images, but also for any decisions made in the course of an investigation.

As I stated earlier, a code of practice will be set out by the Garda Commissioner after consultation with the Irish Human Rights and Equality Commission and the Data Protection Commission. It will then come to me. I will sign it and make it a code of practice, but it only becomes effective if this House and the Dáil approve it. That is where the protections should be in place.

If this amendment was put in, it would inordinately delay the effectiveness and the operation of the tool.

Amendment No. 5 has been ruled out of order.

I move amendment No. 6:

In page 8, between lines 12 and 13, to insert the following:

"Processing and storage of data

43DA.Biometric data processed under this Act shall—

(a) be retained only for the minimum period strictly necessary,

(b) be stored and processed exclusively on servers located within the European Union,

(c) not be accessible to private contractors, and

(d) be deleted immediately once no longer required for the purpose for which it was collected.".

This amendment seeks to ensure greater protection also, in terms of where the data is processed and stored, and to ensure such data is only retained for a necessary period. As we permit the use of this kind of technology to assist the Garda to do its job in terms of detecting crimes and catching criminals, we need to ensure that there are safeguards in terms of where the data is stored and processed, and also who has access to it and that it is not retained for longer than is absolutely necessary. That is basically the gist of this amendment.

I understand the purpose and objective of the amendment because it is important that rules are in place governing the retention of data, how long it can be retained for and its use. The way we are proposing to deal with that is in the code of practice, which is set out in section 10 of the Bill. The Senator will see that section 10 of the Bill refers to a new section 47A, which refers to codes of practice for Part 6A, which is the biometric analysis. The proposed section 47A(2) states that "a draft code of practice shall include provisions relating to [...] the confidentiality, security, storage, access, retention, erasure and destruction of data obtained as a result of the operation of" biometric analysis. It is an important issue but it will be dealt with. The most appropriate place to deal with it is within the code of practice. This House obviously will have a say in respect of the code of practice as it only comes into effect if this House approves it. The provisions of the recording devices Act are without prejudice to the requirements of the Data Protection Acts. The principles of data protection are set out in those Acts and the processing of data, including access, retention, storage, deletion or destruction, will be supplemented by the codes of practice. It is not just the code of practice; it is the data protection legislation as well. I have referred the Senator already to section 47A. I also emphasise that the power provided for in this Bill is for An Garda Síochána only. Consequently, I do not think the amendment is necessary because of what is within the Data Protection Act and what is required to be in the code of practice.

I will speak briefly to section 8, particularly in relation to the crux of the topic in relation to our amendment that was ruled out of order. We will look to submit a similar amendment. It was deemed that our amendment was against the principle of the Bill. Our amendment provided that the output of biometric recognition systems would not be used as a principal purpose. The only logic that we can think of as to why our amendment was ruled out of order is that the Bill intends for the results of biometric analysis to be used as principal purpose in the course of criminal investigations. That fundamentally undermines the assertion in the definitions of the Bill that biometric analysis does not include biometric identification. If the output from biometric recognition systems deployed by the Garda are used as evidence in the course of a criminal investigation, how has the subject of that investigation not been identified as part of the use of those systems?

The system in the Bill gives powers to two members of An Garda Síochána - any rank - and the output is good for principal purpose. The system outlined in the AI Act requires rights, impact assessments from the deployers of the biometric systems and judicial approval for the use of the technology, with that approval being subject to judicial review and many more safeguards. The Bill, as it stands, provides for two gardaí of any rank. I raise the fact that this was ruled out of order because it is not aligned with the principle of the Bill. It would be good to have further insight and understanding as to why it is against the principle of the Bill. It is important to have it on the record regarding the intent of the amendment with the intention of coming back on Report Stage to rectify where it is deemed as not being aligned with the principle of the Bill.

To add, it might be useful if the Minister were to clarify whether that is the principle of the Bill. Is that the purpose of the Bill? Will this biometric analysis be used for principal purpose? Is that the intention? Is that the goal of the Bill? It would be useful for clarifying because that is not what it would seem to be in the text of how biometric analysis is being-----

We have moved on amendment No. 6, but we can discuss the whole section when it comes to the end.

I move amendment No. 7:

In page 8, between lines 12 and 13, to insert the following:

“Prohibition on procurement or use of certain technologies

43DA.(1) An Garda Síochána, the Minister, or any public body acting on their behalf shall not procure, license, contract for, deploy, or otherwise make operational use of any biometric analysis technology, surveillance technology, software, hardware, dataset, or related service supplied by—

(a) a company incorporated, headquartered, or substantially operating in a state engaged in war crimes, crimes against humanity or

genocide,

(b) a subsidiary, affiliate, or parent undertaking of such a company, or

(c) any entity that develops, trains, sources, or operates biometric or surveillance systems using data, infrastructure, or technology originating in a state engaged in war crimes, crimes against humanity or genocide.

(2) For the purposes of this section, ‘surveillance technology’ includes any system capable of biometric analysis, facial recognition, behavioural categorisation, pattern of life analysis, or the processing of biometric data within the meaning of the Data Protection Act 2018.

(3) Any existing contract, memorandum of understanding, or procurement arrangement that contravenes subsection (1) shall not be renewed, extended, or varied, and shall be terminated at the earliest date permissible under contract law.

(4) Nothing in this section shall prevent the Minister from authorising the temporary retention of data or equipment solely for the purpose of evidential preservation, forensic examination, or legal compliance, provided that no further operational use is made of such technology.

(5) No biometric data collected, processed, or retained under this Act shall be transferred to, processed by, or stored on any server, cloud service, or technological infrastructure—

(a) located in a state engaged in war crimes, crimes against humanity or genocide,

(b) controlled by an entity referred to in subsection (1), or

(c) operated using software, firmware, or backend systems originating in a state engaged in war crimes, crimes against humanity or genocide.”.

I am sure Members will join with me in welcoming former TD and Minister of State, John Moloney, and his guests from Laois. They are most welcome to Seanad Éireann. I thank them for being here.

Amendments Nos. 8 and 9 are related and may be discussed together by agreement. Is that agreed? Agreed.

I move amendment No. 8:

In page 8, between lines 18 and 19, to insert the following:

“(ab) contravenes section 43C(1);”.

This amendment would make it an offence without lawful authority or reasonable excuse to knowingly contravene section 43C(1) which states, "A member of Garda personnel shall not carry out biometric analysis other than in accordance with this Part and any applicable code of practice." The Bill already criminalises falsifying, concealing or destroying information obtained by biometric analysis. It does not, however, state that a contravention of the Bill is an offence. The reason this is important is we do not want to see any potential for scope to creep in here. We do not want to see a situation where new technologies, which are emerging all the time, are adopted in a way that is inconsistent with the narrow uses proposed in this Bill. Specifically, this Bill allows for a relatively narrow use of biometric technology in policing by comparing biometric data, for example, faces, across pieces of evidence like photographs or footage that the Garda has already gathered in the course of an investigation. The Minister has made clear that he sees a wider future for biometric technology in policing. Facial recognition technology that compares against a wide database of biometric data is something we in the Labour Party will not accept. This amendment aims to make absolutely clear on the face of this Bill that checking a person's image against a broad database of images is prohibited under this legislation.

Do any other Members wish to contribute?

The new Part 6A inserted by this Bill outlines procedures around the use of biometric identification systems by gardaí. The Bill also provides in the newly inserted Part 8A for a code of practice to be established in relation to the application of Part 6A. Section 43C(1) states that, "A member of Garda personnel shall not carry out biometric analysis other than in accordance with this Part and any applicable code of practice." However, there is no consequence for the misuse of biometric technologies. As we have outlined, the safeguards in place for the application of biometric identification systems under the AI Act are not replicated here. We are not bound by those protections due to the carve-out in Recital 40 and in the absence of these safeguards, these systems are simply open to misuse. This amendment seeks to strengthen the protections against the abuse of making the use of these technologies in contravention of section 43C(1) an offence. Research from European Digital Rights in 2021 into the rise of biometric mass surveillance in the EU found examples of misuse that we should be aware of. In Germany, authorities deployed facial recognition systems outside of LGBTQ+ venues, religious venues, doctors' surgeries and lawyers' offices without any legitimate justification, with a disproportionate deployment of such technologies against marginalised groups. In Poland, the Government has been accused of using spyware with the capability to surveil people's biometric data. In the Netherlands, Dutch police have allegedly used financial incentives to encourage people to share private surveillance footage with police for biometric analysis as a way to evade national laws. The AI Act sought to address these abuses, for example by categorising biometric identification systems as high-risk technologies and recognising the potential impact of the Act by utilising a novel term in biometric analysis to describe instances of biometric identification, clearly not aligning with the safeguards in the Act. We introduce this amendment in that context by making the use of biometric systems in contravention of the provisions of this Bill and the code of practice an offence. We firmly recognise the seriousness of such misuse or abuse. Regardless of whether we call it biometric analysis or biometric identification, identification will happen and court cases will happen. Our point is that because of that, we still need to understand whether the principal use of the Bill is for criminal investigation. Moreover, due to the ability to misuse such technology in such harmful ways as we have seen in other jurisdictions around Europe, it would be wrong of us not to acknowledge the protection needed to ensure that if someone misuse or contravenes the section, he or she would be guilty of an offence. I am not one for creating offences for everything but because other safeguards do not exist in relation to the fact that this will be identification, ultimately, and that identification will be used by the courts, we should ensure there are deterrents in how people may use that analysis and that we also protect the integrity of An Garda Síochána by ensuring technologies are not misused. We see the use of these technologies being abused in all other countries and counterparts. To make the assumption that they are not open to abuse here would be wrong. This amendment simply strengthens the Bill in that regard.

I thank both Senators for their amendments and contributions. Both in effect wish to make it a criminal offence if a member of An Garda Síochána or Garda personnel does not carry out biometric analysis in accordance with Part 6A or with the code of practice. That would be draconian. There could be many examples where a garda inadvertently fails to follow the code of practice or makes a mistake, as we all do in our professional lives, when it comes to the code of practice. If that happened under the amendments put in here, there would be a prosecution of the garda for the commission of a criminal offence. That is excessive. Section 43E at present provides sufficiently for where prosecutions should take place. In the case of falsification, concealment or destruction of information or permitting the falsification, that should be an offence. There is a range of other offences as well that will apply in terms of somebody misusing or deliberately using for other purposes information that was procured from it. That proposal that any breach of the code of practice or if you simply did not follow all the rules in respect of what is set out in Part 6A, that can happen inadvertently. People make mistakes. When people make mistakes, it should not necessarily be the case that they be prosecuted.

I welcome Deputy Connolly and his guest to the Chamber. You are very welcome. I hope you enjoy your visit to Leinster House today. I call Senator Cosgrove.

It is disappointing; we thought this would be a very reasonable amendment. People do make mistakes in their jobs but this is a guardrail. It is not excessive in any way. There should not be room for error when you are talking about biometric data.

Briefly, I agree about creating offences for things that potentially could be human error but the problem is that the ones where it is not human error can have a very serious consequence on the lives of people considering where we see these types of technologies being used. Going as far as creating an offence here is because of the carve-outs that exist in other places. When we look in particular at the information in Article 26(10) about requiring judicial approval for the use of technology, that creates a safeguard before the potential for any abuse or anything in contravention with the Act or the legislation. As those preventative measures have not been put into the legislation, that is why my amendment exists here. However, I would much prefer the Minister to be coming back to the Chamber with some of the more preventative measures that protects from abuse, that looks for that judicial approval, that looks at name and what the rank of garda is in terms of when there is two eyes on a piece of biometric identification. It is about starting here at this worst-case scenario where there has been an abuse and asking where we can walk back in the legislation to make sure we protect everybody from such an abuse. I referred earlier to some other countries. When we look at the Dutch police using financial incentives to encourage people, they are all very serious instances where technologies have been abused. I ask the Minister, between this Stage and when we meet again, to look at how we can put in some preventative measures in the legislation to ensure we do not get to the point where we are looking at the worst-case scenario of asking if there should be an offence if someone is in contravention with the legislation.

I will make a brief intervention here. I have some sympathy with Senator Ruane as regards the collateral damage that can be done to people with the possible misuse of this section 43C(1). I have great sympathy with what the Minister said as well. Sometimes these things are done in error or done through no fault and there is no malice in what has been done. Over countless decades past I have looked at situations where members of the Garda Síochána have been brought through the courts. Their career is effectively destroyed and their families decimated in morale and emotion because vexatious prosecutions were taken against members of the Garda. Taking all of those things into consideration, the reassurances of the Minister in relation to other sections of the Bill do give safeguards against this, so I would not be minded to support the amendment.

There will be a code of practice that will set out disciplinary codes for the Garda Síochána. If a garda misuses this, there will be consequences for the garda but it does not mean there has to be criminal prosecution always.

As it past 3 p.m. the debate is adjourned by order of the Seanad and we will move to the next item.