Mr. Dale Sunderland:

That must be set out clearly by the Department. We are not saying it is not proportionate or necessary but in data protection analysis, one sets out the problem and what one is trying to achieve, the solution. If that is worked through in a systematic and clear way, and if the answer is the PPSN and that decision is well justified, then there is no issue from a data protection perspective. Someone could suggest an alternative identifier or another system, look at the alternatives and decide they are not valid, but it is not for the commission to work through that analysis. That is the responsibility of the Department and it acknowledges that.

As I have already mentioned, the PPSN has been legislated in other ways in the past, beyond the Social Welfare Acts, including in the Credit Reporting Act in 2013 and the central credit register, as well as the Health Identifiers Act, where the individual health identifier, a unique identity for individuals, is created off the back of the public services data set. This can be done. All we are saying is that the Department must clearly set out the analysis and justify the use of the PPSN in a way that complies with data protection. This flows from the Charter of Fundamental Rights and long-standing case law of the European Court of Justice. There is a process that must be gone through, rather than simply saying that we have a problem and we all think the solution is the PPSN. Rather, it is about asking why we think that is the case. That is all the commission is saying and if that justification is made, the requirements around data protection have been met. I hope that answers the Senator's question.