Mr. Dale Sunderland:

I thank the Senator for the questions. I welcome in particular her comments on the importance of the data protection impact assessment, which we see as being central to this process. On the question of whether it is too late once the Bill is enacted to carry out a data protection impact assessment, for some elements it certainly would be. That is why the Department is undertaking a data protection impact assessment of the project as a whole and all of the key elements.

We would certainly be of the very strong view that before the provisions of the Bill are finalised a very detailed data protection impact assessment should be conducted of all of the main elements of the Bill which involve the processing of personal data. I have mentioned PPS numbers in regard to a holistic overview of the central register and how those issues around the engagement between local registers and the central register can be addressed prior to the enactment of the Bill in order to tease out what the issues are and how each of those elements will comply with data protection requirements, in particular the risks that will arise.

The Senator mentioned discrepancies. I agree with her and it is a point I called out in my opening statement. There is some detail that we at the commission do not fully understand yet in terms of how it is going to work in practice. That is why we are anxious to continue our engagement with the Department through the Article 36 prior consultation process in order to find out further detail, see the draft data protection impact assessment and provide our views on it.

The point I was trying to make was that some elements of the project such as, for example, the technical details around establishing the national register, the technical elements of safety and security and how it will work in practice could be teased out after the Bill is enacted. There is a two phase approach.

The Senator also mentioned an audit. At some stage that might be a very good idea because it comes back to the heart of what the current problems are, what are we trying to solve and how we are going to solve it. We then need to make sure that from a data protection point of view the solutions the Bill seeks to provide actually address the issues satisfactorily and in the appropriate way.

That is probably enough from me on the Senator's questions, unless she wishes to follow up. I am of course happy to answer further questions if required.