Ms Clare Daly:

We have a hierarchy and I am the attending Member, so I have to go last. It is nice to be back and it is good to see everyone again. I wish to raise a few issues. First, as far as I am concerned, the Oireachtas Committee on Justice is in many ways uniquely placed to play a constructive role in dealing with the problems that are at the heart of our data supervisory situation - not just in Ireland, but across Europe. I think that perhaps the way the narrative has developed is that it is an Irish problem. I do not see that as being the case. In some ways, actually, the report published by the committee feeds into that narrative. However, having said that, I think the committee could still play a very valuable role in dealing with what the actual problems are. Yesterday we discussed the fact that some of the problems with the system are caused by the Irish legislation. It is an issue that we will also discuss with the Data Protection Commissioner, Ms Dixon, later on. Many of the demands set out in the report by the committee were addressed to the DPC. To my mind, they would be better addressed to the Government. For example, the committee recommended that the DPC should clarify its definitions of cases being concluded or resolved, but it did not deal with the fact that the DPC did not make up that informal process. The informal process is provided for in the legislation. The threshold at which the DPC, in another member state, issues a decision is far lower. When the committee is comparing cases with other cases, it is comparing apples and bicycles.

Moreover, in the report the committee stated that Ireland had issued decisions in four out of 196 cases since 2018. That is not actually an accurate figure. The European Data Protection Board, EDPB, internal marker information, IMI, system figures are based on group cases. The figure could refer to 900 cases. Each case could comprise one, 15 or ten cases. We are being unfair in those comparisons. I think that is very important. We are painting a particular narrative. It might explain why the Irish DPC is a bit defensive. We are saying it is way behind in its work. Actually, in a majority of its cases, it does not issue decisions. It resolves the case and the matter is concluded, but it is not referred to as issuing a decision. The committee used Spain as a comparison in its report, which is not fair. The Spanish legislation allows its data protection authority to make decisions and impose financial penalties at a much lower level. The committee called for the DPC to enforce its powers of sanction, but again, the legislation does not provide the DPC with the power to impose fines directly in individual cases. I want to highlight those issues. Having said that, I believe there are issues to be addressed, but they need to be addressed by the Government. I am wondering, in that context, if the committee has had any dialogue with the Minister and the Department, or the DPC itself about weaknesses in the legislation. I think the legislation may not even be compatible with EU law. I am not sure. The reason why I know and am hung up about it is that when the legislation was being passed, Mick Wallace and I moved amendments to ensure a decision was issued in each case but they were voted down by others. We are in this situation. I am not sure that issuing a decision in every case is the best approach. It could clog up the system because Ireland is getting far more cases. If the cases are being sent cross-border, it could clog up the system. I think the committee is in the best place to discuss these issues. Some of the emphasis around the problems lies beyond the DPC. They are very much legislative issues that we need to address, which is why it is great for us to be able to come in here and look at it. It is great to be here on that basis.