Mr. Dale Sunderland:

As the Deputy will be aware, the PPSN is provided for in the Social Welfare Acts. It is a tight item of legislation with restrictions around the use of the PPSN, so that is a lawful basis for the use of the PPSN where the individual is involved in a transaction with the State. Other legislation in the past has provided for a legal basis, such as the Credit Reporting Act, which allows for the PPSN to be used as an identifier. It has now been proposed to provide a legal basis through this Bill for the mandatory collection of PPSNs for the purposes of identity verification and checking to ensure the integrity of the electoral register.

The job for the Department is to look at every potential. We link this back to the processing of personal data. The processing of any personal data for any purpose requires a legal basis. When it comes to the State processing personal data, we find that most generally in the primary legislation but also potentially in secondary legislation. It is the job of the Department as it goes through the data protection impact assessment to make sure that in addition to what is proposed in this Bill, it has for all the purposes envisaged the appropriate legal basis underpinning any data processing. I mention it in the context of further statutory purposes, which is quite a broad provision. The purposes for which the PPS number would be used are explicit within this Bill but the question arises as to what does other statutory purposes mean. One must find a basis in law for that. One could not assume via collection through this process that one could automatically start using those data for other purposes. The legislation around the PPSN is quite complex and intricate but the value of a data protection impact assessment is to tease all those issues out.