Mr. Barry Lowry:

I thank the Senator for his questions. On the first question, you could argue that this is putting the cart before the horse. As the Senator will know, with any good idea, you need to get an understanding of what the potential is for the idea in order to start to get robust questions about it, which is what he has just given me. What the Commission has tried to do in the statements and communications it put out is to get people to understand what it is trying to achieve and then to hear user concerns in order to shape the regulation. I have absolutely no doubt that in due course the European data protection commissioners will take a detailed look into what is planned and will comment in a very detailed way on any modifications that would be required. That relates the Senator's second question on how the scheme will be designed.

The one thing that this scheme will not do is create a huge bucket in which every single public and private piece of information about us will be held and can be disclosed to anybody who is interested. That is what it will not do. I think it will be a distributed data model. We are used to that, conceptually in any event, because in Ireland, for example, our driving data is with the Road Safety Authority, our tax data is with Revenue, our welfare data is with the Department of Social Protection and so on. Any data that is shared in Ireland must be underpinned by a data-sharing agreement that has to be written in line with the GDPR. Under the new process, there is a data protection officer in each public service body who must basically confirm that he or she is satisfied with GDPR compliance before it is allowed to proceed. I know from the digital Covid certificate that we had to go through reviews by the data protection officer in the HSE, the data protection officer in the Department of Health and our own data protection officer in the Department of Public Expenditure and Reform before we could even go to the Data Protection Commission to get its views on the way forward. So I think that we have a very robust data governance system in Ireland. We will absolutely uphold that as we introduce this initiative or any other initiative.

In terms of the actual broader sharing of data, the key point is the idea of individual sovereignty. I understand that if I want to buy a car, I may need a driving licence.

I may need them to know that I am legally entitled to drive that car. They may need to know that I have proper insurance and so on. All of that requires data sharing. We were used to doing it by simply bringing along forms. This might be a way in which it can be done more conveniently, for example, on the day when one is supposed to be picking up keys or whatever that happens to be. We need to make sure that people are not retaining data for longer than they need to. If a person moves from one insurance company to another, the previous insurance company cannot keep the same levels of detail and so on. We need to protect that.

On the constitutional issue around the citizen's identity card, the one thing that underpins the MyGovID at the moment is that it is not mandatory. It is a choice by people who want to receive their public services online. Obviously, where that happens the State has an obligation to protect all of its citizens by making sure that personation is not taking place. The State has designed a process that enables this to happen but it is not a mandatory process. If a person wants to carry out the old manual process then he or she is very much entitled to do so. We are seeing, however, that more and more people want the digital process because it is simply so much faster. I do not see any compromise with the Constitution. It will not be mandatory and people do not have to opt in. It is entirely their own choice. They can opt in for a period of time and then opt out again. Again, that is entirely of their own choice.