Mr. Seamus Carroll:

I thank the Deputy for the question. The Barrett judgment is, of course, very interesting. It dates from October 2015 and highlights two requirements. First, there must be an adequate legal basis for the sharing of personal data between bodies. Second, and this is a crucial point in the judgment, it is not sufficient that there be a legal basis; there must also be full transparency where public bodies are sharing data with each other. For example, that could involve providing adequate information on the websites of the bodies concerned as to the sharing arrangements which are in place.

Consent is not always a requirement when it comes to dealing with public bodies. For example, when it comes to taxation matters, consent has little role to play and what the Revenue Commissioners do is underpinned by legislation, not by consent. Whereas consent may provide a valid legal basis for the processing in many cases, when it comes to the activities of public authorities and bodies, a statutory basis is necessary - a basis in law rather than a basis in consent or in contract.

I do not particularly want to be drawn into the detail of the health legislation, which is being considered separately. However, going back to the point the Deputy raised for the future, there must be a lawful basis for the processing and there must also be greatly increased transparency. As I said earlier, whether it is a public or a private body, and we often see terms and conditions on websites that would require considerable effort to understand, for the future this must be much more transparent and must be written in clear and plain language that can be readily understood.