Mr. Dale Sunderland:

Yes that is one mechanism but whatever way it is done, it must be provided for by legislative means. I have also seen examples where powers are given to the Minister to implement statutory instruments. In that way, one could put on a statutory footing certain aspects of how the right is to be further restricted.

The DPC's general point of view is that it is preferable this would be included in the primary legislation. As was said, it would be possible then to use a code of conduct to set further practical standards for its operation and to ensure all data controllers implementing the restriction do so in the right, common and standardised way.