Ms Helen Dixon:

There is a resourcing reality, clearly, to everything we do but it is not the starting point. The starting point is that we take a risk-based approach in terms of deciding where to allocate resources. We look at the number of complaints around a certain type of processing that we might receive. We may see media reports in relation to certain types of processing, particularly issues with multinationals that we may want to look into.

We look at the number of affected individuals of a particular processing operation. So, for example, with the PSC, it clearly could affect every individual in the State because children's data is also processed, in the context of the PSC, given that they have been issued to individuals under the age of 18.

We look at the potential nature of impacts on the rights and freedoms of the individuals whose data is being processed. So could the data processing operations give rise to adverse impacts for individuals where decisions are being made about them in circumstances that are unfair and where they are not on notice in terms of the purposes of use of their data? We bring to bear a range of factors in terms of the risk-based analysis. We now have, under one of the deputy commissioners who is not here today, a process where we convene a committee within the DPC that looks at areas of high-risk, considers the realities of our resourcing, and makes decisions then on the areas that we will pursue for large-scale investigation.