Mick Wallace (Wexford, Independent) | Oireachtas source

According to page 45 of the annual report, which provides an update on the public services card investigation, a draft report of the investigation containing "13 provisional findings" was issued to the Department of Employment Affairs and Social Protection for comment in August 2018. I am curious about the use of the word "provisional" and I ask our guests to elaborate on it. In what way are the DPC's findings in the draft report provisional or subject to change? While I am familiar with the statutory inquiry workflow as outlined in the annual report, I am curious to know whether the DPC's findings at this draft report stage might change based on steps taken by the Department as the data controller in the period between receiving the draft report and the DPC's final decision, for example to address issues of coerced consent or the lack of a legal basis for processing. Is it the case that the findings are provisional because the data controller might offer a further defence against the findings contained in the draft report? Perhaps out guests could comment on the concerns that this process involves a certain amount of collaboration between the regulator and the data controller.

The workflow of the statutory inquiry is set out on pages 28 to 30 of the annual report. Is it the case that step 6 in the process, in which the "DPC decision-maker notifies [the] DPC draft decision to other concerned EU data protection authorities", is necessitated by Article 60 of the GDPR, which refers to "Cooperation between the lead supervisory authority and the other supervisory authorities concerned"? Is the statutory inquiry process, including for example the European Data Protection Board dispute resolution phase of the process, the same for all DPC statutory inquiries? Is the same process or workflow for these types of investigations used by all data protection authorities in the EU? Do our guests think this process is applied in a consistent manner across the EU?

Late last year, a spokesperson for the DPC indicated that no more than a summary of the parts of the final public services card report which are deemed to be in the public interest would be published. I ask our guests to elaborate on what is meant by the public interest in this context. How could it be in the public interest to conceal aspects of an investigation? Do our guests agree that if the full report is not published, there will be a problem with the transparency of the investigation? As I see it, this investigation has real potential to be a definitive or landmark statement by the DPC on data processing in the public sector, regardless of how the DPC rules on the various elements of the investigation. During Question Time in the Dáil last month, the Minister, Deputy Regina Doherty, told me she "would have the legs cut off" her if she went against the DPC's clear instruction not to release the draft report. The Minister did not understand my question. I was actually asking about the possibility of publishing the DPC's final decision, rather than the interim or draft report. Will our guests clarify whether the DPC has instructed the Minister not to publish the draft report? If it has, why was such an instruction given?