Mr. Fred Logue:

The basic principle is that the Data Protection Commission is supposed to be the primary legal remedy or independent adjudicator on disputes over data protection. It is a public body but it is completely independent of the State. Its job is to supervise how the State implements the GDPR. This includes disputes where it is disputed that the legislation is actually valid regarding the GDPR. Similar to the Workplace Relations Commission, the Data Protection Commission has the power to disapply conflicting national law. I have already expressed concerns to another committee about the lawfulness and constitutionality of the procedures. There is no sworn evidence and no hearing. They tend to get bogged down and in many cases, the Data Protection Commission ends up being a middleman between the opposing sides exchanging points of view and finally deciding to go with one or the other. It does not have that characteristic we have for dispute resolution involving a hearing or even exchange of legal submissions. Characteristically, the procedure is very slow. It takes a very long time. It is measured in years whereas it is actually quicker to go to court to litigate because one can move things along. Pre-Covid, one could get a Circuit Court hearing in six months whereas I have cases involving the Data Protection Commission that are over three years old. One is not getting that effective remedy. As the Deputy alluded to, part of the solution lies in making this more efficient. It will make decisions that will be challenged in court. That is part of the legal process. It is through those challenges that the law gets clarified or the legislation is struck down but one needs the feed - the pipeline of Data Protection Commission decisions - so that one can get to court to get that clarity. Everything is stuck at the Data Protection Commission level and is not getting through so that the law can be clarified. That is a major issue but it is outside the scope of the legislation.