2026-02-05

65. Deputy Sinéad Gibney asked the Minister for Foreign Affairs and Trade whether her Department has concerns regarding the ability of citizens to exercise their rights under GDPR and the EU AI Act being undermined by the provisions currently proposed in the digital omnibus simplification packages; whether these concerns have been raised in early discussions on the packages; and if she will make a statement on the matter. [8708/26]

70. Deputy Darren O'Rourke asked the Minister for Foreign Affairs and Trade her Department's stance on the digital omnibus proposal, in its current form, as published by the European Commission; the proposed changes or concerns they have; and if she will make a statement on the matter. [7871/26]

There is a lot of talk right now about online safety and regulation. The overwhelming sentiment from the public is that we need to tackle it head on and not be cowed into inaction by big tech. Yet the digital simplification packages as currently drafted stand to erode people's rights, not support them. Is the Department concerned about the package? What steps is the Minister of State taking to raise these concerns at EU level?

I propose to take Questions Nos. 65 and 70 together. I am grateful to both Deputies Gibney and O'Rourke for tabling this timely intervention. The Government strongly supports the EU’s competitiveness agenda. Simplification is a key enabler of this. The European Commission put forward ten separate simplification omnibus packages in 2025. Each package usually contains several legislative proposals relevant to multiple Departments. My Department has been co-ordinating Ireland’s approach across government to these packages. The digital simplification omnibus package was published by the European Commission on 19 November last year. In the lead-up to its publication, Ireland strongly encouraged an ambitious digital simplification package that can support the EU’s strategic positioning as the location of choice for trustworthy digital innovation, while maintaining a central focus on protecting data privacy and fundamental rights of citizens. The proposals are a first step, and an important element of the overall approach to improving competitiveness at an EU level in line with the Draghi report and related work. The package contains two legislative proposals, which are the digital omnibus on AI and the digital omnibus. The first legislative proposal, the digital omnibus on AI, aims to simplify and streamline the EU’s AI Act. The proposed changes to the AI Act respond to practical implementation challenges highlighted by stakeholders and are aimed at increasing certainty for regulators, businesses and citizens, reducing compliance costs and administrative burdens, and supporting innovation while maintaining protections. The Government has welcomed the EU’s focus on simplification, having consistently advocated for targeted and proportionate regulation, ensuring the right balance between stimulating innovation, boosting competitiveness and enforcing regulation when necessary. The second proposal, the digital omnibus, aims to simplify and streamline the EU’s data rulebook and cybersecurity incident reporting. The Government welcomes the proposed amalgamation of the open data directive, the free flow of non-personal data regulation, the Data Governance Act and the Data Act into a single consolidated data Act as it will streamline the data framework and provide greater clarity and alignment of the data rulebook. The Government supports amendments to the general data protection regulation, GDPR, that can reduce compliance burdens but maintain the strong safeguards on the use of personal data in keeping with the core principles and objectives of the GDPR. Essential principles of public trust, transparency, data protection and improved public outcomes and public good are central to any simplification package. The Government further welcomes the efforts to simplify the reporting of cybersecurity incidents as the complexity of incident reporting has been repeatedly highlighted by stakeholders as a major issue, particularly for SMEs. However, we have concerns on the proposal to develop a single entry point for incident reporting across a number of legislative files, including non-cybersecurity ones such as GDPR. Discussions on these proposals remain at an early stage. We will continue to consult with stakeholders and engage constructively in these discussions. It is important to note also that the proposals under the digital simplification omnibus package must proceed through the EU’s ordinary legislative procedure, requiring review and approval by both the European Parliament and the Council of the EU, which we will have the Presidency of for the second half of this year. As we move forward, it will also be important to future-proof the EU digital regulatory framework, with the overall aim of increasing the coherence and effectiveness of the EU's digital rulebook. This means ensuring forthcoming digital regulations are developed with the same objectives around simplification, harmonisation and coherence strongly to the fore. In this context, the Government supports the broader review of the digital rulebook through the fitness check of the digital acquis announced by the Commission as part of this package.

I am really frustrated by the Minister of State's reply, as I was by a similar answer given by his colleague the Minister of State, Deputy Smyth, at the AI committee last week. The dogs in the street know big tech cannot be trusted. We have all endured the Grok scandal over the past number of weeks. A recent "Prime Time Investigates" programme reported on how our location data is being sold. Despite all of that, the Government remains stubbornly committed to backing omnibus proposals that give the very tech companies that are harming us more of our data and subject them to less regulation and oversight. There seems to be a disconnect between the rights and protections of citizens and the push for deregulation. We are not seeing any critical engagement on how this will impact ordinary people. I am really concerned that at a time when we should be shoring up protections and rights, they are being totally ignored. The conversation is completely about how to remove rules. We are told that this is about simplification and harmonisation and that they will be achieved while balancing rights. Those rights are always the secondary thought. Unfortunately, I do not see any balance. Digital regulation and our digital rights cannot be construed as two separate issues. That does not work because the regulations exist in the first place to protect those exact rights. There are not adequate safeguards in the proposal from the Commission. What will the Minister of State do to ensure that is addressed in any digital omnibus package?

I share the concerns that have been raised, which were not addressed in the Minister of State's response. The identified concerns include the impact on the ability of citizens to exercise their GDPR rights, that a redefinition of personal data may narrow GDPR protections, a risk to enforceability of rights, expanded derogations and reduced obligations, and the weakening of safeguards on sensitive data, including AI. Similarly, in regard to the EU AI Act, there are concerns regarding delayed or diluted high-risk AI obligations, potential for underclassification of high-risk systems and relaxed rules on processing sensitive data for AI training. In his response, the Minister of State repeatedly made the point that he wants to support the implementation of this proposal and reduce compliance burdens while maintaining safeguards and protections. In fact, those protections and safeguards are being diluted and whittled away. We need the Government to stand up against that.

It is important that I be crystal clear on this matter. The Government's position is that simplification must be about better regulation, not deregulation. We need to reduce the regulatory burden, particularly for SMEs, while maintaining high ambition in terms of protections, including environmental, human health, privacy and a range of other standards. The omnibus proposal is not actually an omnibus; it comprises ten pieces of legislation and we are referring to just one element here. The role of the Department of foreign affairs is to co-ordinate all Government responses to the proposal. Some of them will come from the Department of Enterprise, Tourism and Employment, and Deputy Gibney has referenced the role of the Minister of State, Deputy Smyth. Others will come from the Department of Health, the Department of the environment and so on. It is really important that our legislative approach be in line with core better regulation principles and the inter-institutional agreement on better law-making while prioritising smarter, simpler and more streamlined regulations. The Government recognises the importance of regulation, crucially to ensure markets operate efficiently and fairly. That in no way waters down our recognition that we also need to protect consumers in a range of areas. In that context, it is important that regulations are targeted and proportionate to the policy objective, whether it is to protect consumers and citizens or to promote competitiveness and innovation. That is why the Government had advocated for a dynamic, ambitious and risk-based approach focused on removing regulatory overlaps and administrative burdens, for example, while also supporting compliance. This package was introduced in November. We are in the position of working through it in each of the different frameworks and policy areas. I hear the Deputies' concerns. They are valid and they need to be worked through. However, I do not necessarily conflate seeking to make things more simplified and more competitive with a rush to deregulate and some form of race to the bottom. I reject that assertion. It is worth working through this process in its entirety.

The Minister of State telling us simplification is not deregulation is as hollow to me as saying the removal of the triple lock will not affect our neutrality.

Where is the relevance?

It is just misleading. He said in the same breath that it is about relieving the regulatory burden. He must admit that what he is doing is removing regulations and, therefore, removing rights and protections. He referred to stakeholders in his first contribution. Who are those stakeholders? I am fairly sure they are businesses and industry. My problem with the governance we are pursuing in this area is that it is completely driven by the Department of enterprise. It is not considering the broader societal impacts of online and digital harm while we are all experiencing those impacts. We are potentially allowing companies to self-certify their AI in lower-risk categories. We are potentially allowing companies to collect personal data that previously was protected. I mentioned the "Prime Time Investigates" report that, not too long ago, exposed how we are allowing third-party companies to track us using our data. Now we face a situation where that data is not even illegal to collect and sell. I do not disagree with the Government that we have huge issues with the enforcement of these regulations. What I disagree with is walking away from those regulations and seeking to get rid of them instead of properly enforcing them.

This move cannot be stripped away from the wider context around AI and the conversations happening internationally about how the European Union is a difficult place to do business, how America needs to be the home of it and where Britain stands post Brexit. The real risk is that protections are hollowed out because Elon Musk and the huge tech companies will have their way. They have very willing allies in the White House. That is something against which we must caution. As a measure of the Government's assessment of this proposal, has the Minister of State's Department conducted an internal assessment of the potential impact on citizens' ability to exercise their GDPR rights arising from the proposed redefinition of personal data? That would be one indicator.

I will not be baited by the needless false comparison from Deputy Gibney in somehow bringing the triple lock and neutrality into this really serious debate. She asked who the stakeholders are before, without any evidence, telling me they are just businesses. In fact, stakeholders include civil society, work organisations, the trade union movement and citizens as a whole. There is a clearly enshrined EU consultative process. This is a really serious issue and I accept the bona fides of both Deputies in raising concerns. I do not dismiss their concerns for an instant. I may disagree with some of their points, which is allowed in this House, but I do not need to start making false assertions. Deputy O'Rourke makes a very fair point in terms of what assessments are being carried out on an internal basis. Each assessment is done, depending on the policy area, by the relevant line Department. Regarding the initial assessment in relation to GDPR and citizens' rights, overall assessments, although not necessarily as specific as the Deputy outlined, are carried out by each Department, including the Department of justice, which is the relevant one. It is our responsibility in the Department of foreign affairs to co-ordinate those assessments and provide unified responses when we come to discuss this at a Council meeting or between officials at COREPER level.