Mr. Denis Kelleher:

That is precisely the concern. Many data subjects will not object to the processing of their personal data for the purpose of being paid a grant, obviously, but if they do not get it, they may object. There are, under Article 6.3 of the GDPR, some specific elements that have to be within the law. There is a debate on whether the provision needs to be in every item of legislation that provides for the paying of a grant. In that regard, I suggest this issue be addressed by the GDPR essentially setting out that Ministers can create statutory instruments, perhaps, to include relevant elements, if they consider it necessary to do so, to allow themselves flexibility, reserving a position that where there is a general power to pay out money or process people's personal data in a particular way, one can do so. The issue of data sharing arises in that the structure of the State is such that each Minister is in charge of his or her Department. Each Minister is, therefore, a data controller. The classic example involves the transfer of data from the Department of Health to the Department of Social Protection. Section 8 of the Health (Alteration of Criteria of Eligibility) Act 2013 which is quite obscure providers for the Revenue Commissioners or the Department to go to the Department of Social Protection to access information and vice versa. Where one provides for the payment of a disability grant from the Department of Social Protection, for example, that Department could access the systems of the Department of Health and Revenue to identify a person's health records to ascertain whether he or she is really disabled and his or her income to determine whether he or she should receive the grant. That is the power needed in the sharing of data. One needs to consider the complexity of the data sharing and the impact on individuals. What the GDPR is doing is bringing a layer of complexity to these decisions.