Mary Seery Kearney (Fine Gael) | Oireachtas source

I am mindful my time is short. There needs to be a clarification about data controllers. Today when we are talking about the national offices and national political parties, we are operating in an environment where the national party is the data controller of the information it holds. Each individual member, whether a candidate, a local representative or a representative at national level, is also an individual data controller. Deputy Gould did not appear to understand that distinction in the line of questioning he engaged in, so clearly more training is needed for Sinn Féin.

I go to the Sinn Féin privacy notice regarding the Abú database, which clearly states the database comprises the electoral register and the marked electoral register, with additional canvass information. The screenshot of the dashboard of the Sinn Féin Abú database, as published by Philip Ryan, a journalist for the Irish Independent, shows that people are under headings of hard support, soft support, strong opposition, unknown or not in, and whether they voted in previous elections or did not vote. There are buttons for analytic statistics. There is an opportunity to create a canvass relating to an individual.

There are shared canvasses and there is manual voter match. In the context of the information it states it collects, the lawful basis of processing does not appear to set out in the privacy notice or on what it is relying. There seems to be an indication that it uses legitimate interest. For legitimate interest to be lawfully used as a basis for processing, it must pertain only to members of an organisation, former members or people who are actively engaged with the organisation. Where does the Sinn Féin data protection impact assessment, DPIA, cover the use of the electoral register, marked and unmarked, in the Abú system?