Ms Anna Morgan:

I thank the Vice Chairman. As regards the general enforcement structure contemplated by the general scheme of the Bill, a very different regulatory framework applies to the DPC. Obviously, the tasks and powers of the DPC emanate from EU law and the GDPR. There is an obligation on supervisory authorities under Article 77 of the GDPR to handle every complaint and to investigate each complaint to the extent appropriate. There is an obligation on the DPC under section 109 of the 2018 Act, which gives further effect in Ireland to those regulatory obligations, to seek to amicably resolve complaints in the first instance. The committee will note that approximately 60% of all the complaints the DPC received last year were concluded within that year. Of course, those issues do not seem to be in contemplation in terms of the structure which is currently foreseen within the general scheme.

In terms of the larger scale enforcement and the system of deterrence measures, it is quite different to the structure that is contemplated under the 2018 Act and the GDPR insofar as the general scheme seems to provide for a system of compliance notices and warning notices. The latter would follow where compliance notices are not complied with by an online platform. Flowing from non-compliance with a warning notice, there is the possibility for criminal sanctions as well as various applications that can be made to the court. The maximum level of fine, set at 10% of turnover, is even higher than that provided for under the GDPR, which allows a maximum fine of 4% of the annual global turnover of an organisation.