Mr. Dale Sunderland:

I thank the Deputy for her questions. She asked about the data protection impact assessments, DPIAs, and whether it is too late at this stage to carry them out. The first thing to say is that the Department is currently carrying out a DPIA. We can look at it in a few different ways. We can look at the systemic overall issues with the project. That should be done now, at this drafting stage. It is important for that process to continue prior to the Government signing off on the final text of the Bill. That can be done at this stage. Issues around personal public service numbers, PPSN, other risks around the national register, how it will interface with the local registers, the registering authority etc. can all be dealt with. One can then look at subsets of that when it comes to implementation. The online infrastructure, public portal and all those things can be looked at in separate data protection impact assessments, which we certainly recommend. For example, commencing the new provisions around pre-seeding the register and things like that can be looked at in further data protection impact assessments after the Bill is enacted. A data protection assessment is always a living document and should be continuously reviewed and updated as necessary.

Finally, as I mentioned in my opening remarks, Article 36, which is the statutory requirement under the GDPR for public authorities to consult the Data Protection Commission on draft legislation, has not yet completed. We will continue to engage with the Department and provide our views.