Ms Helen Dixon:

I thank the Deputy for his questions. The first issue he raised is that of an independent review of the DPC, although he also mentioned a multi-stakeholder forum. I am not sure if that was raised as being one and the same. I would make a few points about having an independent review, quite apart from the various levels of scrutiny the DPC is under in terms of reviews of its decisions by the courts, the presentation of its annual report, which is laid before the Houses of the Oireachtas every year, and the governance scrutiny under which it operates with internal audits, the role of the Comptroller and Auditor General and so on. An important point to mention is that we have rolled out a further iteration of our consultation on our strategy as a regulator, our enforcement and our regulatory strategy. Stakeholders may wish to be aware we published that next iteration last week. We would be very happy to receive inputs, comments, critiques and ideas regarding that regulatory strategy, which will serve as a forum of review and reflection for the DPC.

An independent review of the DPC is something this committee may wish to form its own views on. I would suggest, in line with my earlier comments, it is very important that if a review was set up that it would seek to do more than skim the surface. It would have to engage with the idea of correctly and comprehensively measuring the effectiveness of regulation and enforcement to the extent that it would have to engage with the European element of the role the DPC has and it would need to have the capability to do that. In setting it up, there would probably need to be a consultation with the European Commission on it.

Given the very particular independence of an authority like the DPC and the role we have in regulating personal data processing by Government, there might be question marks over the Government establishing an independent review, lest it should be considered that it was trying to stymie enforcement actions against itself and so on. We are always open to the idea of review and the input of ideas but it would need some consideration. I am not sure exactly what the committee is considering when that question is put to me.

In terms of three commissioners, it is quite correct that section 15 of the 2018 Act future-proofed itself by providing for additional commissioners. In the experience of the DPC to date, that is not where any bottlenecks have occurred. Albeit almost three years have now passed, but we are in the earlier stages of the GDPR with a broad base of newly-opened investigations under the 2018 Act, not all of which have progressed to decision-making stage at this point. The appointment of additional commissioners is a matter for the Government.