James Lawless (Kildare North, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

The Max Schrems case which generated an investigation by the Irish Data Protection Commissioner in 2012 related to third party consent which is exactly what the Kogan app used in 2013 which came out of Cambridge Analytica in 2016, 2017 and 2018. Am I right in saying that if action had been taken at that time none of the sequence of events that followed would have been possible?

When the Cambridge Analytica story broke in The Guardianand Channel 4 we saw the unedifying spectacle of the Information Commissioner in the UK bizarrely appearing on TV to say she would get a warrant and a week later appearing to enter with the warrant. It is generally not a good idea in criminal law or in evidence gathering to give people a week's notice of one's arrival. I understand there were several legal reasons for that because I read the detail afterwards but are we prepared, is the Office of the Data Protection Commissioner sufficiently resourced, to deal with a similar incident if it arose here?

Are the powers there in legislation? If the commission needs a warrant is there a process which can be used to get a judge at night, if needs be? Is the commission confident that the same situation would not arise here and that it has the necessary enforcement and dawn raid powers? If it does not have them the witnesses should tell us what they need and we will see if we can give them the powers.

We are five or six weeks away from the implementation date for the general data protection regulation, GDPR. I am not sure how ready industry is for this, given that the Bill will only come before the Dáil this week. How ready do the witnesses think business and the State generally are for the deadline of 25 May?