Ms Helen Dixon:

To give a brief outline of the process, as the committee will know we launched the investigation in October 2017. It was a broad-ranging investigation, given the volumes of data processing at issue. We identified a number of issues we would investigate around legal basis, retention and transparency, as well as security and biometric personal data processing. Over the months we conducted the investigation, we identified that we would have to narrow the scope of the investigation and corresponded with the Department to that effect. We limited the first part of the investigation to legal basis retention and transparency.

In advance of issuing the draft report to the Department in August 2018 with our provisional findings, we had identified we did not have sufficient information on all the areas we were examining to make preliminary conclusions. When we issued the draft report, we made preliminary inclusions in 13 areas and made 17 requests for further information to the Department. To answer the Deputy's question, before we issued the draft report we sought some legal advice because it was already clear in the responses we had received from the Department that issues of legal interpretation were being raised, as were assertions that we might be erring in law. As a result, we obtained legal advice in advance of issuing the draft report. The legal advice, which was obtained from a junior counsel in 2018, cost €10,000.