Ms Helen Dixon:

I thank the committee for this opportunity to engage with it on the important data protection considerations that might arise in regard to any reform of the electoral registration process. As the Chairman has outlined, the committee is interested in considering whether the PPS number would be a solution to accuracy, omission and duplication issues affecting the register. I am well aware the committee has been informed by various witnesses that the use of the PPS number would, of course, be no trivial matter.

In the statement I submitted to the committee in advance of the meeting, I set out some of the specific considerations concerning security risks that can arise through over-reliance in the State on one identifier and the ability that could be created to link, potentially unlawfully, across a variety of Government databases. What is at issue is striking a balance between the fundamental right of individuals to have their personal data protected and the public interest in democratic legitimacy through having an accurate voter register. To strike that balance correctly, the Oireachtas will need to ensure the very specific context in which additional personal data are processed is detailed and analysed.

In data protection terms, the devil can often be in the detail of implementation. Consider the example of a registration system involving a centralised verification service within a Department through which local authorities and new individuals who wanted to register electronically could submit their applications and have them validated. A system that did not retain the PPS numbers once it completed a validation exercise would be very different from a system with a centralised electoral register run by one State body and under which the PPS numbers would be permanently retained. Therefore, we need to understand in detail what we mean by use of the PPSN to resolve the issues with the electoral register. It is important we outline precisely for what, in what circumstances, by whom and how the PPSN would be used in any proposal.

Equally, however, it would be preferable to start examining a range of solutions to the issues identified with the register and testing the solutions to determine whether they resolve the issues that have been identified. The committee heard previously that there are potentially more PPS numbers than persons eligible to vote and, conceivably, persons eligible to vote who do not have a PPS number.

A range of solutions would need to be identified to deal with these issues. Solutions would also need to be assessed so that they did not cause further issues beyond those that are sought to be resolved. Ultimately, for any final proposal, a thorough privacy impact assessment would need to be carried out on the proposed solution to ensure that the implementation delivers the best protection of personal data as well as the most effective and efficient process for dealing with personal data.