Mr. Denis Kelleher:

Yes, it is, but it is still not a law. It is an administrative scheme. I am not saying there would be no difficulty but essentially there would be less difficulty if one turned the memorandum into a statutory instrument. There is a clear distinction to be made between a law and an administrative scheme. I understand from where the difference originates. Essentially, the GDPR is European legislation. In many European civil law systems memoranda cannot be laws; therefore, they would have laws where, in many cases, we would simply have memoranda. In a sense, the Irish legal system is disadvantaged by this in terms of data protection. The European law requires that one process personal data on the basis of a legal obligation that must be set out in legislation. In this case, a memorandum will not be adequate to provide that legal basis. There must be a law, be it a statutory instrument or primary legislation, setting it out. If one wishes to share data between the Department of Social Protection and the Department of Health, there must be legislation that allows for this. In the example I give the legislation would be a statutory instrument. There are other examples such as the Health (Alteration of Criteria for Eligibility) Act 2013 where it is set out in primary legislation. It enables the transfer of data between Departments. A law is required as opposed to a memorandum. It is an obligation under the GDPR which specifies that under Article 6(3) the processing of personal data by a Government Department must only be done on the basis of legislation. I have provided a detailed memorandum for the committee. Where I discuss head 4 I point out that the legal basis must be set down in member state law to which the controller would be subject. A memorandum is not a law.