Mr. Dale Sunderland:

It does make sense. The Deputy is referring to the role of the DPC as an independent authority for assessment of compliance with data protection law. In a hypothetical situation, should either party make a complaint to the DPC stating that his or her personal data, because of this Act, or Bill when enacted, has been unlawfully processed, we would handle that in accordance with our procedures. We would assess the issues, handle the situation in an appropriate way and investigate it to the extent necessary. All of the procedures under the Data Protection Act 2018 would kick in.

I want to be clear that this is about data protection. We can only regulate in respect of the processing of personal data. Bigger issues are at play here regarding privacy rights and the DPC does not adjudicate per seor directly on those. The DPC only comes into play in the context of article 15(4), for example, where the rights and freedoms of others have to be taken into account. First and foremost, however, our regulatory responsibilities and only mandate is to regulate in respect of the processing of personal data. Theoretically, a complaint could be submitted to the DPC. We would have to adjudicate that complaint fairly and impartially as we are required to do under law and then make a determination on whether the processing of the personal data was lawful or not.