Ms Anna Morgan:

I thank Deputy Jack Chambers for his questions. On the age of digital consent, which relates to Article 8 of the GDPR, which is a challenge in itself in regard to the obligation on organisations to take reasonable steps to verify that consent has been provided by the holder of parental responsibility where consent is the basis for processing children's data, in other words, the data of anybody in Ireland under the age of 16 years. This goes to one of the core issues we are considering in our consultation, namely, how organisations can adequately verify age to identify whether a child falls below or above that threshold. Connected to that, there is the obligation on organisations and online platforms to verify parental consent in regard to that processing. A range of different methods has been used by organisations, some of which have been based on the Children's Online Privacy Protection Act 1998 in the US, known as the COPPA Act. COPPA is detailed legislation that specifically deals with these issues and sets out a range of different techniques, whereby organisations can potentially attempt to verify that the holder of parental responsibility has given consent to the processing. One of the methods referred to in the legislation is the use of micro-payments on a credit card, the theory being that somebody over the age of 18 years will have access to a credit card. We are aware that certain online organisations and companies rolled out this measure as a means of verifying whether consent had been adequately given. We are aware that those companies have received a certain amount of criticism from parents who believed that the gathering of this additional financial information was excessive and disproportionate to the obligation on the organisation to verify parental consent. It is a very complex issue and one that we intend to fully explore in the context of our consultation. We will address it in the best practice guidance that we intend to issue after the closure of that consultation.

On the issue of the allocation of resources and staffing levels for the organisation, the Data Protection Commissioner has mentioned on a number of occasions that from 2014 onwards, the Government committed to increasing the funding of the Data Protection Commission in that year and to keeping it under review. It has done this and the budget allocation to the commission has increased every year since 2014. The budget for 2019 is €15.2 million, which is a dramatic increase from the €1.7 million allocated for 2013. We are very much of the view that adequate funding for the Data Protection Commission is critical for it to continue to build its capacity and enable it to perform as an internationally respected, effective and robust regulator. We have very much welcomed the increases in the budget in recent years.

In terms of the impact of the budget on staff, as I mentioned in my opening statement, we currently have 135 staff and we intend to recruit further staff in specialist areas by the end of this year, particularly in the legal, technology and investigatory functions.

These are priority areas of recruitment for us. We intend to reach a staff complement of 165 by the end of 2019 based on this year's current budget allocation. We also anticipate that we would need 190 staff by the end of 2020 and 220 staff by the end of 2021, based on our analysis to date of the trends and increasing volumes of matters that we are dealing with. The funding issue remains vital to us being able to continue to perform in the manner that we must do, under the GDPR, and fully perform our functions under the expanded remit of the new legislation.

Finally, I shall deal with the question on gambling. We do not have a regulatory remit for the gambling sector per se. However, there will be or may be many situations where personal data could be used in the context of the gambling sector. Some of the issues referred to might relate to online behavioural advertising, which is an issue that the office has examined in a number of different contexts. My colleague, Ms O'Sullivan, will comment on the issue of online behavioural advertisements.