Mr. Denis Kelleher:

It is important to say that the GDPR will take over the governance role to a significant extent. This means much of the impetus in this regard will come from Europe. The role of the Oireachtas and the Government will be to implement controls like the assessment of the impact of data protection and the appointment of data privacy officers. Mr. O'Brien might have more to say about what those controls will look like. They will be driven by the European legislation in a very real sense. The Deputy also referred to the lack of penalties. One of the reasons I wanted to flag the possibility of creating an offence was that it might increase the understanding of public servants who are asked to share data. The advantage of creating an offence is not that it will necessarily lead to a whole load of prosecutions, but that it will give public servants who are asked to transfer or process data in a particular way the authority to say that the existence of a criminal offence in this sphere means they need clear instructions on how they should process that data. The big benefit of creating an offence in this area is that it would empower public servants to raise questions about these activities.