Ms Anna Morgan:

In general terms, as members may know, the DPC has always reinforced the importance of an ongoing dialogue with multinational and technology companies to drive better awareness and increased understanding of the rules on data protection and, in particular, the interpretation and position of the GDPR in respect of those rules. The ongoing dialogue we have with companies serves a very important function and has resulted in us becoming aware of the potential roll-out of products and services where we can input into the data protection compliance of those products and services and influence the technology companies on the manner in which they intend to move forward where we perceive risks to data subjects.

The statutory inquiries we have opened involve a completely different process to our consultation and engagement function. Those statutory inquiries, 15 of which were opened into the multinational sector during 2018, have as their ultimate objective the reaching of a decision on whether there has been an infringement of one or more of the GDPR rules. There are a number of stages to those processes and they are quite formalised. Our annual report refers to the overall linear process. Members will see a graphical depiction of that on page 30 of our annual report. In essence, the process involves the stages of information gathering, evidence collection, setting the scope of the inquiry and applying the law to the evidence gathered to assess whether there appears to be an infringement of the legislation. There is then the formal decision-making process whereby the decision-making function in the commission is engaged to make a formal decision which has status under the 2018 Act and to then consider whether, if an infringement has occurred, a corrective power should be applied. That is a very different process from the supervision function. I might hand over to my colleague, Ms Jennifer O'Sullivan, to say a bit more on the supervision of multinational companies and, in particular, statutory inquiries.