Mr. Denis Kelleher:

It is difficult to say. As I say, there is the possibility of illegality and damages claims being brought. The main thing about this legislation is that it proposes a very high standard of procedural steps that data controllers like public authorities have to go through, including such things as data protection by design and the thought of appointing a data protection officer, DPO, and engaging in such things as data protection impact assessments. There is a range of processes that they need to go through and to get in place. It is going to be very challenging for them to be in a position to get those in place in the next year.

On the remedies, I take the Chairman's point on public authorities, because they have a particular status in law. How does one impose a sanction on them? It is a question for the legislature as to how it wants to impose that sort of penalty. I can understand how there would be a certain level of unhappiness in a local authority, from people benefitting from services provided by that local authority, if they discover that the money that was going to be spent on their park, for example, is now being transferred back into public funds to pay a fine to the Data Protection Commissioner. That is how it would be perceived even though all that would hopefully happen in that situation is that the money would come back out again. One has to be careful not to get into that issue of perception about what is an effective remedy.

I take the Chairman's point that one has to look very carefully at whether or not there are effective sanctions. The real risk and concern for the State here is rather than that circular transaction, which might ultimately create some bureaucracy, there may be damages claims being brought. This may then result in people extracting money from the State and budgets being lowered quite significantly because public authorities have to pay out damages claims. That would be my concern.