Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1697750464111.pdf (Ireland)
Joint Committee on Housing, Local Government and Heritage Pre-legislative scrutiny of the general scheme of the Electoral Reform Bill Opening Statement of the Data Protection Commission 23 March 2021 I thank the committee for the invitation to contribute to your deliberations on the general scheme of the Electoral Reform Bill.

I am one of the Deputy Commissioners at the Data Protection Commission, with responsibility, among others, for the DPC’s supervision, consultation and guidance functions.
Also in attendance is David Murphy, Assistant Commissioner, from the DPC’s supervision and consultation section.

The DPC welcomes the opportunity to engage with the Committee on the proposed Bill and to provide our views on the draft provisions that impact on the processing of personal data.

By way of background, I can inform the Committee that the Data Protection Commission submitted contributions to the public consultations on proposals to modernise the electoral process.
In contributing to the public consultations, the DPC welcomed the Department’s goal of building an electoral register that is secure, comprehensive and accurate, while being fully compliant with data protection legislation.

In view of the very substantial volume of data involved, the establishment and maintenance of an accurate and secure central electoral register is of critical importance to the public’s trust in the proposed reforms.
The DPC’s submissions made observations relating to the use of the PPSN and to the sharing of personal data for the purposes of updating and maintaining the register.

Regarding the proposed use of the PPSN, the DPC advised that any use of the PPSN must be shown to be a justifiable solution to identified issues with the electoral register, while not having a disproportionate impact upon an individual’s right to data protection.
This assessment should address known vulnerabilities with the PPSN such as the potential for fraudulent use.

It may also be necessary to examine whether the legal basis for the PPSN as found in the Social Welfare Acts can support the issuance of a PPSN to an individual for the sole purpose of registering as an elector, a scenario that could conceivably arise in the case of European and local elections.
As part of a general recommendation to adopt a “data protection-by-design” approach, the DPC recommended the use of a Data Protection Impact Assessment to explore fully the data protection risks involved in these proposals, and to consider the implementation of suitable and specific safeguards.
We also pointed out that any use of MyGovID or the Public Services Card for optional online registration should be examined to ensure that there is a valid legal basis for such processing, and that the rights of data subjects are upheld at all times.

The Committee should be aware that the DPC has engaged with the Department of Housing, Local Government and Heritage on the proposed Bill.
We understand that the Department is conducting a 1 Data Protection Impact Assessment and that the DPC will be formally consulted under Article 36 GDPR during this process.

In particular, the rationale and justification for the mandatory collection of the PPSN and use of the Public Service Identity data set, must be fully assessed in the DPIA.
The Department must remain open to alternative solutions should the justification for use of the PPSN and PSI not be satisfactorily grounded, or where there is an inability to mitigate any identified high risk to the personal data of individuals, whether or not those persons are included on the electoral register.

The DPC recommends the publication of any DPIAs and ancillary supporting documentation developed during this process in the interests of transparency to the public.
I will now turn to the DPC’s views on specific provisions of the General Scheme.

Heads 28 -80 - Functions of the Electoral Commission On the establishment of an Electoral Commission, the DPC welcomes the oversight and reporting functions of this independent body, in particular in monitoring the accuracy and completeness of the electoral register.
Head 90 - National electoral register shared central database Head 90 provides for the establishment of a central database for the management of registration data by a registration authority on behalf of others, including the provision of a public interface.

The DPC recommends the carrying out of a DPIA prior to the implementation of this proposal, given the scale of the database, to identify risks and appropriate safeguards.
The Registration Authorities must also determine their roles and responsibilities with regard to the controllership of personal data, and to ensure that these are underpinned by appropriate data processing agreements where necessary.

Further clarity may be required as to the operation of these provisions e.g., how discrepancies will be avoided between records held by registration authorities and the central database.
Any data processing must also be subject to appropriate safeguards, including where necessary the implementation of data protection policies.

We would also recommend that consideration be given to whether further provisions are required in the Bill to set out how it is intended that the existing electoral registers will be updated with additional personal data, such as the PPSN, on the enactment and commencement of this legislation.
Head 92 – Use of the Electoral Register Head 92 sets out provisions concerning the use of the electoral register which is limited to electoral or other statutory purposes, with reference to the provisions of Sections 39 and 40 of the Data Protection Act 2018.
Any processing of personal data for a statutory purpose must comply with the data protection and eprivacy legislative frameworks in general, and in particular with the requirements of Article 6(3) of the GDPR, which requires that the basis of any processing necessary for compliance with a legal obligation or in the performance of a task carried out in the public interest be laid down by EU or Member State law.
2 Head 93 – Data Sharing Head 93 sets out the legal basis for the sharing of personal data for the purposes of verification of the accuracy of the register of electors, and its updating and maintenance.

As I have already referenced, the carrying out of a DPIA should be undertaken to establish the justification for the use of each element of the verification data set on the basis of necessity, and to identify a clear legal basis for processing.
As with previous legislated uses of this data set, such as for the Individual Health Identifier, it is expected that any use of the PSI dataset will be limited to verification purposes, and that the PPSN will not become a de facto unique identifier within the electoral register itself.

The governance of, and access to, personal data used for verification purposes will be a key consideration for the DPIA process, as well as the retention of any such data.
In the drafting of this legislation, it is noted that consideration will be given to the timing of the commencement of relevant provisions of the Data Sharing and Governance Act 2019 and its bearing upon this section.

Notwithstanding that Act, the DPC recommends for the purpose of providing an explicit legal basis in primary legislation for data sharing, that this Head be retained and consideration given to further specifying the modalities of data sharing in this Bill.
Heads 86, 101, 104 – Registration of Electors of No Fixed Address, Anonymous Electors, and Pending Electors Heads 86, 101 and 104 set out provisions for the registration of persons of no fixed address, anonymous electors, and the registration of pending electors.

In each of these areas, given the novelty of processing, the DPC recommends that Data Protection Impact Assessments be undertaken.
It is noted that the establishment of a list of pending electors will require the processing of the personal data of children.

The DPC has advised the Department to take account of our recently published draft guidance titled, Children Front and Centre: Fundamentals for a Child-Oriented Approach to Data Processing.

Head 121 – Online Political Advertisement The DPC notes the provisions of Head 121, setting out the public information requirements for online political advertisements.
The transparency requirements for such advertisements touch upon the processing of the personal data of electors in the areas of micro-targeting and the compilation of advertising targeting lists.

Persons or parties engaging in online political advertising, that involves the processing of personal data, must already adhere to the relevant provisions of the data protection legislative frameworks (GDPR, the Data Protection Act 2018, ePrivacy Regulations).
The requirements set out in Head 121 will bring an extra level of transparency to such activities, which is welcomed.

I hope these comments will be of assistance to the committee and I am very happy to answer the questions members may have.

3