Mr. Dale Sunderland:

I am not aware of any other such examples of information sessions, but that is not to say it is inherently problematic. I am not passing judgment one way or another. It is simply from the perspective of trying to ensure the right of access is fully respected, in that the rights of other individuals are not adversely affected and then a controller, or in this case, the Department and the Minister are proposing there should be safeguards in place. One of the safeguards identified is an information session. It is not to say some other safeguard would not provide an equally appropriate means by which to ensure Article 15(4) is respected.

With regard to the point under head 2 and the exclusion of certain categories of data, if that is to be seen as a restriction of a data subject's rights, and acknowledging the GDPR provides for the restriction of rights, it has to be justified as such. I would like to reflect on it again, hearing some of the comments earlier, but in principle, the balancing of what the Department is trying to achieve here is feasible once the requirements of Article 23 are adhered to. If something is not explicitly restricted in the Act or the proposed Bill, the GDPR still provides and the rights still stand. If there are elements of data, other rights or other areas of activity by each of those controllers which have not been explicitly restricted in the Bill and there is no other explicit legislative restriction in either primary or secondary legislation, the GDPR still applies in full to those other areas.

A concern was raised that if there is a restriction in the Bill or if something is captured in the Bill, that would mean controllers are free of other rights. That is not the case, if it is not explicitly provided for.