Patrick Costello (Dublin South Central, Green Party) | Oireachtas source

I want to clarify one thing. One of my earlier points was that head 12, which makes reference to the records being in line with the code of practice, should also state "and in line with GDPR and in line with data retention legislation". Is it enough to have the purpose of the gathering and processing in the code of practice? Should that be in the legislation or, more realistically, should it be in both?