Mr. Seamus Carroll:

Data protection principles require that data be used for the purposes for which they are collected and not for another purpose incompatible with them. There is an enhanced right in Article 17 of the regulation to seek erasure of personal data. In the part which gives effect to the directive it is made clear that data controllers or, in other words, competent authorities must also ensure they have retention periods for personal data or that they have policies governing the retention periods. As the Deputy said, there is increased emphasis on the right to seek erasure of personal data. There is also an enhanced accountability principle, whereby data controllers and processors, be they in the private or the public sector, must demonstrate compliance with these instruments and the Data Protection Commission will have a clear power to carry out audits. It will, therefore, not necessarily wait for complaints to arrive to carry out its enforcement activity. It may take a more active role with this audit facility.