Mr. Denis Kelleher:

They are then unable to perform their statutory functions. If, for example, the Data Protection Commissioner was to impose a fine on a Department of €1 million, as a result that Department has to either stop providing services to citizens or alternatively get an emergency allocation of €1 million to make up that loss. The fine does not go to the Data Protection Commissioner, it goes into the general funds. In a sense then there is a circular transaction. I am going to state, in the classical lawyer fashion, that this depends on which direction one wants to follow. The preference in this State is that public bodies not fine other public bodies because that is seen as a circular transaction. This has been the convention to date in this State.

In my view, the very real penalty that would be imposed on public bodies would be twofold. First, they would not be able to do their job and consequently would have a problem there. Second, if the DPC decides that a public body is processing personal data illegally then the data subject in question would be able to bring claims for damages against that body. That may be a very real penalty on them.