Mr. Barry Lowry:

First, apologies for putting the wrong heading on my opening statement. My invitation arrived on Tuesday afternoon, so I had only a few hours to prepare it and I was using a template. Perhaps that was a Freudian slip, and I will touch on that.

The main area raised for me to address was digital and safety concerns, and the process behind moving Ireland forward in terms of the digital agenda. To be clear, we have looked very carefully at MyGovID and its appropriateness as the single electronic identifier as opposed to other options, including starting again, and it is by far the best value for money to move forward with MyGovID. I believe it will become ever more important in the world of the general data protection regulation, GDPR, because if people choose to make requests online on the data a public service body holds on them, we need to be absolutely certain that they are who they say they are as a data breach situation would occur otherwise. MyGovID gives us a huge degree of protection against that.

In terms of Departments sharing data, I am not a lawyer but I rely on the advice of the Attorney General's office. When any public body is set up by the State to provide a service, its legal standing in being set up to provide that service gives it a right over certain datasets. When Departments share data, they have to abide by the principles of GDPR anyway. They were long established before the regulation came out, so there has to be a demonstration that the data are necessary. There are elements of specificity and proportionality. It has to be time-bound, and there has to be an element of consent. All of those are strengthened by the GDPR.

The data-sharing and governance Bill will help the State comply with the European eGovernment Action Plan 2016-2020 and, more recently, the Tallinn agreement, which is that we should not ask a citizen for information we already hold and record about them. The data-sharing and governance Bill will ensure that sharing among Government bodies takes place but is driven completely by the principles of the GDPR and excludes completely sensitive data.