Mr. Daragh O'Brien:

In regard to the ROS system, it is a wonderful public sector IT success story. One of the key elements of Revenue is that they have a very strong culture of guarding their powers over data and guarding the data over which it has powers incredibly carefully because, ultimately, everything it does, in particular in the self-assessment context, is based on trust. If people stop trusting the taxman, there is a concern that will undermine the ability to use automated online systems and result in a return to the 1980s. My father is ex-Revenue, and I remember Revenue audit work in the 1980s and the pressure people working in the public sector were under at that time.

In terms of whether the legislation is keeping pace with change, it is worth bearing in mind that European law is principles-based, rather than technology-based. One word one will not find in the Data Protection Acts, the current directive or the GDPR is the word "computer". It applies to physical and electronic records. In that context, the legislation is keeping pace with change.

As Mr Kelleher said, the GDPR is a very clever piece of legislation because it creates some interesting governance requirements and structures and makes it an offence not have them in place. That is a very strong evolutionary step in the legislation.

In the context of public sector data sharing, it is important that any legislative framework that is put forward to underpin that sort of sharing reflects the theme and ethos of principles-driven legislation within a very strong governance component, rather than focusing on a linear enabling of technology. That is where we have found problems in the private sector with data sharing, the integration of datasets and introducing customer relationship management systems or integrating 11 different customer views.

One of the key learnings from the private sector is that there is no such thing as a single view of the customer. There are different perceptions of the customer as they interact at a point in time. How best to represent the relationship is the next challenge from an information management perspective in that context.

To speak to the Senator's question, the law will always lag behind to an extent, in terms of how it is enforced or supported. From a European and Irish context, it is principles-based. In the first instance, referring to the principles and doing what feels right in the context of the principles is usually a good rule of thumb.