Mr. Billy Hawkes:

The household exemption is already provided for in law and states that when one operates as a private individual in dealing with family or personal issues, data protection law, in terms of the responsibilities of an organisation to give access to data and only collect the minimum amount, should not apply. In a family circumstance one does not ask one's child whether one can take a photograph and vice versa. There are issues about its extent and how far it should go. The general view is that people operating on social networks are covered by the household exemption and, therefore, do not take on the obligations under data protection law, even though the social networks have certain obligations.

Security is a bottom line issue in data protection law and is strengthened in the new law in terms of the obligations on organisations to ensure they have the appropriate security measures in place to protect the data given to them. This is strengthened in the form of an obligation on organisations to report security breaches to regulators and the individuals affected. We already have this in Ireland, on the basis that it is compulsory for telecommunication companies under European law. As a type of soft law, we have a code of practice which states one should report such breaches to the commission and the individuals affected. It is a bottom line issue in data protection law. It is challenging because of the sophistication of those attacking information systems and it is certainly an issue on which we focus very strongly in audits.