Joint Committee on Housing, Local Government and Heritage díospóireacht -
Tuesday, 23 Mar 2021

General Scheme of Electoral Reform Bill 2020: Discussion (Resumed)

Chairman

The committee is continuing pre-legislative scrutiny of the general scheme of the electoral reform Bill 2020. We are joined from the Data Protection Commission by Mr. Dale Sunderland, deputy commissioner, and Mr. David Murphy, assistant commissioner. We are also joined by Ms Liz Carolan, executive director of Digital Action. Opening statements have been circulated to members. I ask witnesses to make their opening statements first and then members will be invited to ask their questions.

Members attending remotely from within the Leinster House complex are protected by absolute privilege in respect of the presentation they make to the committee. I also remind members of the constitutional requirements that members must be physically present within the confines of Leinster House or the Convention Centre in order to participate in public meetings. For witnesses attending remotely, there are some limitations to parliamentary privilege and as such, they may not benefit from the same level of immunity from legal proceedings as a person who is physically present. Members are reminded of the long-standing parliamentary practice to the effect that they should not comment on, criticise or make charges against a person outside the Houses or an official, either by name or in such a way as to make him or her identifiable.

The opening statements submitted to the committee will be published on the Oireachtas website after this meeting. I invite Mr. Sunderland to make his opening statement.

Mr. Dale Sunderland

I thank the Chair for the invitation to contribute to members' deliberations on the general scheme of the electoral reform Bill. I am one of the deputy commissioners at the Data Protection Commission, DPC, with responsibility, among other things, for the DPC’s supervision, consultation and guidance functions. Also in attendance with me is Mr. David Murphy, assistant commissioner, from the DPC’s supervision and consultation section.

The DPC welcomes the opportunity to engage with the committee on the proposed Bill and to provide our views on the draft provisions that impact, in our view, on the processing of personal data. By way of background, I can inform the committee that the Data Protection Commission submitted contributions to the public consultation on proposals to modernise the electoral process held in 2019. In contributing to the public consultations, we welcomed the Department’s goal of building an electoral register that is secure, comprehensive and accurate, while also being fully compliant with data protection legislation. In view of the very substantial volume of data involved, the establishment and maintenance of an accurate and secure central electoral register, in particular, is of critical importance to the public’s trust in the proposed reforms. Our observations in the public consultations related to the use of the PPSN, in particular, and to the sharing of personal data for the purposes of updating and maintaining the register.

Regarding the proposed use of the PPSN, the DPC advised that any use of the it must be shown to be a justifiable solution to identified issues with the electoral register, while not having a disproportionate impact on an individual’s right to data protection. We stated that the assessment should address known vulnerabilities with the PPSN such as the potential for fraudulent use. In looking at the use of the PPSN, it may also be necessary to examine whether the legal basis for the PPSN, as found in the social welfare Acts, can support the issuance of a PPSN to an individual for the sole purpose of registering as an elector. This is a scenario that could conceivably arise in the case of European and local elections while recalling that the purpose of a PPSN is to allow an individual to engage with the State in the course of a transaction with a State body. There may be scenarios where not everyone has a PPSN. We do not have a definitive answer on that but we have certainly think it is something worth considering.

As part of a general recommendation to adopt a data protection-by-design approach, we recommended the use of a data protection impact assessment, DPIA, to explore fully the data protection risks involved and to consider the implementation of suitable and specific safeguards. We also pointed out that any use of MyGovID or the public services card for optional online registration should be examined to ensure that there is a valid legal basis for such processing.

The Committee should also be aware we engaged with the Department of Housing, Local Government and Heritage on the Bill. We understand the Department is currently conducting a data protection impact assessment and the DPC will be formally consulted under Article 36 of the General Data Protection Regulation, GDPR, during this process. In particular, the Department’s assessment should set out the rationale and justification for the mandatory collection of the PPSN and use of the public service identity set. The Department must remain open to alternative solutions should the justification of the use of those data elements not be satisfactorily grounded, or where there is potentially an inability to mitigate any identified high risk to the personal data of individuals, whether or not those persons are included on the electoral register. That is not to prejudge the issue. It is simply to say that the purpose of a DPIA is to go through all of those issues, to ensure there is a justifiable basis and the processing is proportionate and necessary. We also recommend the publication of any DPIAs and ancillary supporting documentation developed during the process in the interests of transparency for the public and trust of the public in the process, and to provide the reasons why certain data sets may be required.

In our submission to the committee we made a number of remarks on our view on specific provisions of the general scheme. In the interest of time, I will not mention them all but I will go through some of them. In relation to the national electoral register shared central database, we understand under head 90 that the database is for the purpose of management of registration data by a registration authority on behalf of others, including the provision of a public interface. We recommend the carrying out of a data protection impact assessment prior to the implementation of this proposal, given the national scale of the database, and in particular to identify risks and appropriate safeguards.

The registration authorities must also determine their roles and responsibilities with regard to the controllership of personal data, and to ensure that these are underpinned by appropriate data processing agreements where necessary. Further clarity may be required as to the operation of these provisions such as how discrepancies will be avoided between records held by registration authorities and the central database. It may be the case that all records will be specifically held on the central database but it is not absolutely clear to us at this point how this would work in practice. Any data processing must also be subject to appropriate safeguards including, where necessary, the implementation of data protection policies. We also recommend consideration be given to whether further provisions are required in the Bill to set out how it is intended the existing electoral registers will be updated with additional personal data, such as the PPSN, on the enactment and commencement of this legislation.

In terms of the use of the electoral register, as provided for under head 92, we note it is limited to electoral or other statutory purposes, with reference to the provisions of Sections 39 and 40 of the Data Protection Act 2018. To underscore the point, any processing of personal data for a statutory purpose must comply with the data protection and e-privacy legislative frameworks in general, and in particular with the requirements of Article 6(3) of the GDPR, which requires that the basis of any processing necessary for compliance with a legal obligation or in the performance of a task carried out in the public interest be laid down by EU or member state law.

Head 93 sets out the legal basis for the sharing of personal data for the purposes of verification of the accuracy of the register of electors and its updating and maintenance. As I stated, the carrying out of a data protection impact assessment, DPIA, should be undertaken to establish the justification for the use of each element of the verification data set on the basis of necessity and to identify a clear legal basis for processing.

As with previous legislated uses of this data set, such as for the individual health identifier, it is expected that any use of the PSI data set will be limited to verification purposes and that the PPSN will not become a de facto unique identifier in the electoral register. That is our understanding from our engagements with the Department. The governance of, and access to, personal data used for verification purposes will be a key consideration for the DPIA process as well as the retention of any such data.

We note that consideration will be given to the timing of the commencement of the relevant provisions of the Data Sharing and Governance Act 2019 and its bearing upon this section. Notwithstanding that Act, the DPC recommends, for the purpose of providing an explicit legal basis in primary legislation for data sharing, that this head be retained and consideration be given to further specifying the modalities of data sharing in this Bill. That is simply for the purpose of having specific clarity on the legal basis for data sharing.

We note head 121 on online political advertisements. In part, this head sets out increased transparency around the public information requirements for online political advertisements. Anyone engaging in online political advertising involving the processing of personal data must adhere to the relevant provisions of the data protection legislative frameworks. We welcome this provision as it will bring an extra level of transparency to online political advertising, in particular as it relates to data protection, micro-targeting or the use of other advertising targeting lists.

I thank the committee for the opportunity to present to it this evening. I hope these comments will be of assistance in its deliberations and I am very happy to answer the questions members may have.

Ms Liz Carolan

I thank the joint committee for the invitation to speak to it today. It has been great to see cross-party consensus on the necessity of the Bill. Making sure our elections run well is essential for our democratic health. Protecting the integrity of our elections is more than a question of democratic health; it is a national security issue. Recent international experience shows that complacency in this regard can have long-term damaging ramifications.

In Ireland, our democratic processes are respected, although sometimes it feels as if this is in spite of rather than because of our fragmented and outdated electoral management system. I believe the committee agrees with me on that point and it is an issue the Bill aims to address.

The world has changed since the Electoral Acts were written. Online political advertisements are a major innovation that has exposed loopholes in our rules. In producing the Bill, Ireland is one of the few countries in Europe that have progressed lawmaking on political advertisements. Taken in isolation, the provisions on advertisements are good. There are legally binding obligations on platforms for transparency, a ban on the overseas purchase of political ads, which was a major loophole, and detailed requirements for imprints on individual ads. From my experience and having consulted experts, the provisions could be strengthened, particularly if they were to require publication of advertisements to an archive as they happen in real time, a requirement that is missing from the proposed Bill, if transparency provisions were extended beyond the electoral period, and if the issue with the definition of "political purposes", as raised by the Irish Council for Civil Liberties, ICCL, and the Coalition for Civil Society Freedom, were addressed. While it is acknowledged in a footnote on page 7 that there is an issue with the current definition, it is maintained in the Bill.

Social media advertisements are just one product and there is a risk that we will build legislation and an institution around a single product. We have come to be concerned about online political advertising since the 2016 US presidential election and the UK Brexit vote because they now constitute a threat to the integrity of elections and represent an evolution in campaigning. The use of technology in campaigning and attempts to undermine elections have evolved further since then. There is a strong possibility that the Bill, as drafted, could be out of date by the time it reaches the Statute Book.

The most recent general election in Ireland saw the growth of digital campaigning. Dr. Niamh Kirk in Dublin City University, DCU, did some great work on this. The next general election is likely to see further reliance on online campaigning, especially in the context of the Covid-19 pandemic. We could also see the adoption of new uses of campaign technology seen in recent elections elsewhere, including influencer advertising, which was a major source of spending in the US, the use of attack videos, so-called AstroTurf campaigns, super PAC-style online campaigns and, most worryingly, the manipulation of online discussion to suppress voter engagement. We may also see issues emerge around the equal playing field, which is a value that is already implicit in our electoral laws, with online advertising markets set up in such a way that wealthier campaigns can drive up advertising costs and price out competition. None of these issues is anticipated in the general scheme. It is impossible to draft legislation that can account for each of these and continue to do so as new technologies emerge and can be manipulated and misused.

On threats to democracy, an example of where online advertisements contributed to threats to democracy was international interference campaigns over social media platforms, enabling spending of money from outside the country to directly target voters. We saw this in Ireland during the 2018 referendum. In the past, these campaigns outside Ireland focused as much on voter suppression and engendering mistrust in institutions as they did on supporting or denigrating particular candidates.

The Bill prohibits the purchase of advertisements on social media platforms from outside the State and creates an offence if platforms fail to implement proper due diligence. This is a really strong provision which fixes a current loophole. However, we know that information and interference operations are broader than paid political advertisements. This was evident last week when the US report on attempted interference in its most recent elections was published. These operations are continually evolving to exploit new technology, such as messaging apps, fake profiles, viral unpaid content and so on. It is also clear internationally that interference operations begin long before the official election period. The Bill, as drafted, would not allow the Electoral Commission to assess the technology and act to address these and other evolving threats. It does not mandate for transparency in political activity outside the narrowly defined periods. This is a missed opportunity to address the lack of a statutory body in Ireland with responsibility for ensuring that Irish elections and referendums are free from international interference and predicting threats to electoral integrity. We may feel that Ireland has room for complacency in this regard but the prospect of another EU referendum or, indeed, a border poll should worry us, especially in relation to maintaining voter trust in the process and outcome.

As we establish our electoral commission, we should build an institution that is empowered to adapt as campaigning and threats to democracy evolve. This is in line with the ambitions for the Bill set out by the Minister on its publication and before this committee. However, the Bill, as drafted, is not quite there yet and would not create the institution that we need. I agree with experts who have already been before the committee, Professor David Farrell, Dr. Jane Suiter and Dr. Theresa Reidy, who said the Bill is a static design for an ever-evolving dynamic environment. Achieving this ambition will take innovative thinking with regard to the structure of and accountability for the new electoral commission. There are some precedents for this in other fields such as environmental and health protection, for example, the precautionary principle. Rather than set out in great detail how we might regulate some parts of campaign technology such as online advertisements, it is worth exploring whether the legislation could instead enforce standards and principles governing our elections and allow for the creation of an institution that is empowered to assess and create rules around transparency and also enforce transparency on new products and tactics as they emerge.

Witnesses at previous hearings mentioned the importance of ensuring in the legislation that the body is sufficiently funded, equipped with a research function and has funding to support independent research capable of assessing risks.

It would be positive if we could broaden the scope from just thinking about voter engagement to include actively monitoring and tackling any voter suppression operations, which we know the Internet is particularly suited to.

Deputy Paul McAuliffe

I always know we are going to have a good session when I agree with good chunks of both opening statements. In particular, I agree with Ms Carolan regarding us having a stronger, more independent and better resourced electoral commission. We waited the best part of 30 years for this to come. The question is whether we get it started or wait for the perfect. That is always the decision of politicians. I will come back to that but I only have five minutes so I will put some quick questions to Mr. Sunderland. It is good to see him. In a number of places, he spoke about seeking to find out if there is a legal basis for the use of the PPSN. Has he formed a view on that and has he advised the Department of that?

Mr. Dale Sunderland

As the Deputy will be aware, the PPSN is provided for in the Social Welfare Acts. It is a tight item of legislation with restrictions around the use of the PPSN, so that is a lawful basis for the use of the PPSN where the individual is involved in a transaction with the State. Other legislation in the past has provided for a legal basis, such as the Credit Reporting Act, which allows for the PPSN to be used as an identifier. It has now been proposed to provide a legal basis through this Bill for the mandatory collection of PPSNs for the purposes of identity verification and checking to ensure the integrity of the electoral register.

The job for the Department is to look at every potential. We link this back to the processing of personal data. The processing of any personal data for any purpose requires a legal basis. When it comes to the State processing personal data, we find that most generally in the primary legislation but also potentially in secondary legislation. It is the job of the Department as it goes through the data protection impact assessment to make sure that in addition to what is proposed in this Bill, it has for all the purposes envisaged the appropriate legal basis underpinning any data processing. I mention it in the context of further statutory purposes, which is quite a broad provision. The purposes for which the PPS number would be used are explicit within this Bill but the question arises as to what does other statutory purposes mean. One must find a basis in law for that. One could not assume via collection through this process that one could automatically start using those data for other purposes. The legislation around the PPSN is quite complex and intricate but the value of a data protection impact assessment is to tease all those issues out.

Deputy Paul McAuliffe

One of the requirements for printed advertising is that the person's name and address are published as somebody who is distributing information regarding an election. In respect of the publication of someone's personal information, for example, a third party taking out paid political advertisements, does Mr. Sunderland believe that this requirement would be in line with data protection? It is quite important to have that transparency. It exists for printed material. The fact that it is being done online may pose challenges for the operators but if it was not done, it would not provide a level playing field.

Mr. Dale Sunderland

That is a good question. This relates to how the legislation is drafted. If the legislation provides for a person's name to be published in terms of who is advertising online, the Bill will provide for that. It is a bit different from a core data protection issue where we are talking about the processing of personal data. In the context of online advertisements, and the Bill touches on this, it comes up in the context of how people are presented with advertisements and who is presented with advertisements. That comes from how their data are processed in the background for personalisation and other purposes. It does not strike us that there is a problem with the Bill from a data protection perspective in that context but, again, we are just looking at the heads. The onus is on the Department to have considered whether and to what extent personal data are being processed in that context and whether there is any risk involved. Again, it is about the process and making sure the right balance is struck. As the Deputy noted, it is already done in an offline context so if the legislator decides to provide for that in an online context, having done the proper assessments and analysis and having decided it is justified, that is what data protection is about. It is working through the process and making sure any risks are properly identified and addressed.

Deputy Paul McAuliffe

Am I up against time?

Chairman

The Deputy has about another minute.

Deputy Paul McAuliffe

Regarding the question of online political advertising, it only covers the period of the election. We do not in any way regulate spending outside of election periods but equally we regulate heavily political advertising on other broadcasting media such as radio and television. Does Ms Carolan believe we should deal with the regulation of political advertising in separate legislation that deals with it more comprehensively or does she think we should take these steps with a view to working much more widely? I agree with almost everything she said about it and I agree there are significant conflicts with how we regulate other media.

Ms Liz Carolan

With regard to the electoral period, we know that campaigns, including malign information operations, will start well before an electoral period and will often use things like political advertisements to drive people into groups online, which can then be mobilised during electoral periods. It makes sense for restrictions on legitimate political actors to be confined to the electoral period in accordance with the values in our current electoral law. However, I do not see any reason transparency provisions cannot be live all the time. This will also enable civil society, journalists etc., to forensically look back and investigate what is going on when things start happening during an electoral period. We need that information to be there and to be available. In terms of whether there is a need for-----

Chairman

Sorry Ms Carolan, I have to stick to time. I have no doubt we will return to that question.

Deputy Eoin Ó Broin

As my questions follow on from that point, Ms Carolan can hold her thought because we will come back to it in a second. I thank the witnesses for their opening remarks. The submissions will be very helpful to us when we get to Second and Committee Stages. I am very old fashioned. I happen to think that the less money is involved in politics, the better, particularly the less money is involved in political advertising. Deputy Paul Murphy and I have been the cheapest Deputies in the current and the last Dáil, coming in at about one third of our allocated expenditure. I have always thought there should be significantly longer periods for the regulation of expenditure by electoral candidates. The idea that it is only the money we spend in a three or four-week period is crazy when one can front-load all one's expenditure in the months before that, so I certainly appreciate some of what Ms Carolan is saying.

My questions follow on directly from the point Ms Carolan just made. I will pull out three strands. For example, the Broadcasting Authority of Ireland strongly recommends that there should be broadly the same types of regulations for all different media platforms. As Ms Carolan rightly referenced, the ICCL talks about the need for a distinction between elections and electoral actors and broader issue-based campaigning etc. While Ms Carolan is obviously talking about the need for online participation, there seems to be a suggestion that her proposals at the end might under certain circumstances have a certain degree of tension with the ICCL. I want to tease that out. Am I misunderstanding that? Is is more that Ms Carolan is calling for greater transparency rather than greater restrictions for the non-electoral element of the regulation? Could she tease that out?

My next question relates to the key bolded bullet point in Ms Carolan's conclusion. If something is not in a Bill, it does not happen. Therefore, for those of us who would like to take up the points Ms Carolan is raising and make the case for them to be included in the Bill, could she talk about what she would like to see in the Bill that would give effect to her key recommendation in the third last paragraph of her submission? How would it enforce standards? What kinds of principles would apply and how can the institution be empowered through the legislation to be able to deal with that evolving set of circumstances?

That would be helpful.

Ms Liz Carolan

I will start with the point relating to the ICCL. I know that the issue that the consortium has been pushing for quite some time is that the essential activity civil society engages in has been classified as political, which can have an impact on its ability to receive funding. It takes very serious issue with the definition of issue-based advertising falling under the same realm as electioneering. I am happy to share an initial piece of work with the committee that is coming out of a consortium with which we are involved across Europe and which is looking at whether all advertising should, by default, be transparent and that what we should be looking at is blanket provisions around transparency in advertising and then restrictions for electoral advertising. The question is whether we should have a separate category for the need for transparency around issue-based content as opposed to electioneering content. I am in agreement with the ICCL on that front.

In terms of what the recommendation could look like in concrete terms, I guess this goes to the Deputy's point about the broadcasting regulations as well. As matters stand, the default when new technology is introduced into our online domain is permission. If we think of analogies, for example, in environmental regulation, we use the precautionary principle which is where we say one cannot dump chemicals into the river and if the fish die then we will start to regulate. We say that instead we need to think proactively about the implications of new technology being introduced, in that instance it is in the environmental area, but when it comes to our discourse and to how political discourse takes place.

In response to Deputy McAuliffe's point on whether we wait for the perfect legislation, as it stands, the Bill is 300 pages. It gets into quite excruciating detail around political advertising, nearly to the extent of what the comma-separated values, or CSV, file should look like when the data are published, but there is no mention of voter suppression and having an institution that has responsibilities and a mission to protect both our electoral integrity and, by extension, our national security and giving it powers to apply a set of values on what our electoral system should look like. For example, we were able to introduce the laws that we have around broadcast because the evolution of broadcast was slow enough for us to do so. They were an application of a principle that we have in our legislation, which is that nobody should be able to use the expenditure of money in order to dominate. We looked at TV advertising and we said that is too powerful, we are not going to allow that.

As a result of the fact that legislation cannot keep up, we have basically introduced video ads by proxy. We now have attack ads. One can pay to attack one's rival and say whatever one likes. We are chasing our tails on this legislation a little bit. We are trying to close the stable door. It will require us to take a step back and think about what the structure of an institution which is capable of regulating and protecting electoral integrity in the 21st century looks like. I do not think it looks like the institution that this Bill would create. I think it has to be one which is a genuinely empowered institution to which we say these are the three or five things that we care about in our democracy and we will empower it and give it the research function to be able to assess what is happening.

In 2016, I was speaking in the United States at a big gathering of representatives from electoral commissions from all over the world who were discussing what was happening in terms of the evolution of threats, but there was nobody from Ireland in the room. Everybody was there, namely, the Americans, the British and people from Indonesia, Sierra Leone and Mexico. They were figuring out and discussing how we protect elections but nobody from Ireland was there. When we were doing the project on the referendum which was looking at ads, we found international organisations directly targeting Irish voters to try and influence what was happening. I spoke to the Broadcasting Authority of Ireland, the Standards in Public Office Commission, SIPO, and I even ended up in the Phoenix Park speaking to the security services after the election just to try to find out whose responsibility it is. In the end it was Facebook and Google that took proactive measures as private companies. I do not want our electoral rules to be set by default in Palo Alto. In the United States, the Supreme Court has said that unlimited expenditure by private corporations to influence the outcome of a referendum is constitutionally protected free speech, whether it is Buckley v. Valeo, Citizens United v. FEC or whatever. I have made my point.

Chairman

The point has been well made. I am sorry to have to cut Ms Carolan off.

Senator John Cummins

I confirm that I am in Leinster House. It is easy to say that this is the most important legislation that will come before the committee, but I believe that it is because having a secure, comprehensive and accurate electoral register is fundamental to democracy and that without it, we are at nothing. The current register is wholly inadequate. I have beside me a portion of the 120 letters that were returned to me by An Post, marked "Gone away", "Not known at this address" or "Deceased" for a section of my constituency in west Waterford when I sent a circular and a piece of information. That is unacceptable. It says that something is seriously wrong with the register. I do not believe that it can be fixed without utilising PPS numbers. That comes back to the point on which Deputy McAuliffe asked Mr. Sunderland whether the Data Protection Commission has a view. In 2008, the then commissioner gave evidence to the equivalent of our committee and said that in order to overcome legal obstacles to using PPS numbers or other data held by State agencies to identify electors, the Oireachtas could either seek voluntary consent of electors to use PPS numbers or other data from State agencies for the purpose of compiling the electoral register or legislate to overrule the right of privacy in the interests of the common good, that is, in the interests of enhancing the integrity of the register of electors. My question is whether that is still the view of the Data Protection Commission. I believe having an accurate register with integrity is essential to democracy and it must include the use of PPS numbers. I would appreciate comments on that.

Regarding the transparency provisions raised by Ms Carolan, does she share the view that it is essential that we introduce a system whereby advertising spend on behalf of parties or individuals by others on platforms like Facebook is accounted for on the account of the individual or party? If I go into the Facebook ad library at the moment, if somebody was spending money on my behalf that does not show on my account. It is on the account of some unknown individual who has placed ads on my behalf. Is it her view that it is essential in this legislation and in other legislation that in looking at the transparency period, those individuals are identified, and that the advertising spend is tagged on to the individual or the party in question?

Mr. Dale Sunderland

I thank the Senator for the questions. I note the reference to the previous commissioner's appearance before a previous committee. In essence, the comments made around legislating for the use of the personal public service number, PPSN, still stand and, indeed, that is what this proposed Bill seeks to achieve. The comments made at that time still stand and are valid and relevant. That is what the proposed Bill seeks to achieve. There is no issue there. The Bill will set down a legislative basis that is quite clear.

I will briefly reply to the comment around consent. It is probably not a very good lawful basis for collection of personal data in a context such as this because consent is a free choice and the general data protection regulation, GDPR, sets down clear rules around the use of consent. For the purposes of this process and reforming the electoral register, consent is not an appropriate lawful basis. The Oireachtas, therefore, may be asked to legislate, which is appropriate. The issue we have raised is not whether there is a problem with using the PPSN per se, we are just saying the process should be set out clearly. It then falls back on the Department to ask what is the problem with the current registers that it is trying to solve, what is it trying to achieve and how best can it achieve that. It must work through that process and ask if the PPSN is the best way to sort out the problems with the current registers. The Department says it is, and may well be right, but our view is that it should set out clearly and publicly, in the interests of transparency, the proportionate and necessary justification for the use of the PPSN. It is a sensitive piece of information that is increasingly being used in all facets of Irish life in terms of engagement between the public and the State. It is important for that to be set out clearly.

Senator John Cummins

Does Mr. Sunderland believe that it is proportionate in the interests of the integrity of having a secure, comprehensive and accurate register? That is the question. Is that Mr. Sunderland's view? Is that the view of the commission?

Mr. Dale Sunderland

That must be set out clearly by the Department. We are not saying it is not proportionate or necessary but in data protection analysis, one sets out the problem and what one is trying to achieve, the solution. If that is worked through in a systematic and clear way, and if the answer is the PPSN and that decision is well justified, then there is no issue from a data protection perspective. Someone could suggest an alternative identifier or another system, look at the alternatives and decide they are not valid, but it is not for the commission to work through that analysis. That is the responsibility of the Department and it acknowledges that.

As I have already mentioned, the PPSN has been legislated in other ways in the past, beyond the Social Welfare Acts, including in the Credit Reporting Act in 2013 and the central credit register, as well as the Health Identifiers Act, where the individual health identifier, a unique identity for individuals, is created off the back of the public services data set. This can be done. All we are saying is that the Department must clearly set out the analysis and justify the use of the PPSN in a way that complies with data protection. This flows from the Charter of Fundamental Rights and long-standing case law of the European Court of Justice. There is a process that must be gone through, rather than simply saying that we have a problem and we all think the solution is the PPSN. Rather, it is about asking why we think that is the case. That is all the commission is saying and if that justification is made, the requirements around data protection have been met. I hope that answers the Senator's question.

Deputy Richard O'Donoghue

I thank our guests for coming in. My question follows on and is on the same theme. I am delighted that Deputy Ó Broin has one of the lowest expenses because when one comes to rural areas, one has to travel a lot of miles and cover a lot of ground compared to smaller areas.

Deputy Eoin Ó Broin

It keeps the Deputy nice and healthy.

Deputy Richard O'Donoghue

I want to ask about media platforms under GDPR. Data went out from the Department recently about a new road to check out areas and tell people in that area that they are on a route. Under GDPR, the Department could not send a letter to each of the individual houses but instead had to send them out in a flier system. It meant that only 10% of the people got the fliers because of the restrictions under GDPR. I agree that we need an accurate register. In rural areas, where townlands swap over, people often get a different vote in each individual area. People often get voting cards addressed to two or three individual areas because there are different townlands. The only way of calculating this properly and getting people onto a national register is by using their PPSN because that ensures one person, one vote. Deceased people are still receiving voting cards. Other people are not being put on registers because census takers cannot access properties and are missing half of the data. The first thing a young person gets is his or her PPSN. It is an accurate account of who someone is and records whether they are living in the country or county. It is an accurate account and a way of making a register that is 100% foolproof accurate. It is also a way of showing that someone is in the country at the time of an election, unless there are alternative ways of doing it. To get a register that is 100% foolproof, using the PPSN is the only way forward.

On advertising and the platforms for advertising, we can all see what can happen with advertising when it is used in the right way and the wrong way. It can do damage to certain people, whether it is true or false. I would like to see this legislation being looked at so that there is accountability and anyone who carries out that type of advertising is swiftly dealt with in an appropriate manner. I am following on from the same point that has been raised already and I am 100% behind it.

Chairman

Those were important points about the accuracy of the electoral register and I totally agree with the Deputy. He also mentioned the accountability required in advertising. Does Ms Carolan, Mr. Sunderland or Mr. Murphy want to comment on that or will I move on?

Ms Liz Carolan

I might jump in there. I will also address Senator Cummins's point about the archive that, say, Facebook and Google have at the moment. It sometimes feels to me as if the people who are trying to do the right thing, fill out all the forms and give their phone numbers and all those kinds of things are the ones who end up in the archive. They then see quite a lot of other activity and they do not know from where it is coming. It can be spreading misinformation or connected to someone else and that is not being captured. That is why we need transparency provisions, at a minimum, across all the advertising. That way, we can see it all and journalists can dive into it so that we have a sense of what is going on.

To reply to a specific point made by the Senator, Facebook's advertising archive was built for the US and its laws where a group can be financed to support a candidate's election campaign and that does not count towards the candidate's spending limits because there are none, or they work differently. That archive has not been designed for Ireland and its laws. We should require those platforms to give us all the information that we need, including who is spending money, how much is being spent, what people are saying, where they are saying it and who they are saying it to. We need to ensure that our electoral commission is able to look at that information. It can then assess that against the spending limits and identify that, for example, there are five different campaigns going on for one particular candidate and that goes above the limit. The electoral commission needs to have the power to be able to do that and the platforms need to release the information to allow that to happen.

Deputy Francis Noel Duffy

I thank Ms Carolan, Mr. Sunderland and Mr. Murphy for their statements and contributions.

Ms Carolan mentioned the critical point about how the Bill should tackle the issue of information operations and the threat of international interference in political campaigns, which was evident during the 2016 US elections. It is a complex issue, given the dynamic nature of digital technology, but what kinds of provision would Digital Action propose be part of the Bill to deal with information operations? That is an "easy" question.

Ms Liz Carolan

I have been digging to find out who is responsible for ensuring that the seats Oireachtas Members fill are filled in elections that are free, fair, open, honest and free of international interference. No one is responsible. SIPO has responsibility for ensuring that campaigns do not receive funding from outside the jurisdiction unless it is from citizens located overseas. For self-funded campaigns or operations that are happening online, though, SIPO has no remit. I asked it whether it could do anything, but it could not.

As a minimum, the first step is to have a statutory body that has responsibility for ensuring that our elections are free from international interference, which is not the case currently. It would be a complex job and would require the statutory body to be able to stay abreast of developments in international operations. Many of the major online platforms want to operate within the law of the land. If that law does not say that international interference is illegal, they cannot act even when we find something. That is what we saw in 2018. Facebook and Google prevented overseas groups from purchasing advertisements during the referendum on the eighth amendment because there was ambiguity about some advertisements that were boosting posts by Irish groups, which could have fallen under the provisions relating to illicit overseas funding of third party campaigns in Ireland. That was the slightly tortuous route that they were able to find to ensure that the actions they took were compliant with Irish law. The fact that international interference is not illegal currently and no body has responsibility in this regard prevents us from getting private sector actors to take action. They do not like taking action that is not compelled by or, at least, in line with national legislation. Does that answer the Deputy's question?

Deputy Francis Noel Duffy

Yes. I thank Ms Carolan.

Deputy Cian O'Callaghan

I thank the witnesses for participating in this meeting. I confirm that I am in the Leinster House complex.

I have a question for Ms Carolan, but I will first summarise my reading of some of her points. If I have got anything wrong, she might correct me. Is she saying that the Bill, as drafted, will not protect our elections and referendums from serious and malign international influence and that substantial changes to that section are necessary? Is she making the point that the commission will need to be able to analyse, assess and act in real time?

I wish to explore this matter further. Ms Carolan stated that the precautionary principle was a good model to follow in this context, in that the commission would be able to act to prevent harm before the end of an election or referendum period. There is limited use in having all of the analysis and deciding we should have done this or that only after external influence has been exerted. What sorts of power should the commission have if it is to act? Should it be able to act outside the electoral period? Should it be able to prohibit spending or certain forms of online activity? Should it be able to stop misinformation campaigns? If the legislation gives it the power to act in real time under the precautionary principle, I presume that there will have to be some definitions around that. The commission could not have unlimited powers. What are Ms Carolan's thoughts on these points?

Ms Liz Carolan

On whether I believe the Bill will achieve its stated objectives, it is my opinion that it will not. It will prevent overseas groups from directly purchasing advertising targeting Irish voters because it will place a legal obligation on platforms to carry out due diligence in respect of people who are purchasing political advertisements. Beyond that, however, I cannot find anything else in the Bill.

Many information operations focus on voter suppression, which takes the form of fake voter boycott campaigns that are targeted at particular groups. We saw such campaigns used against African Americans in the US. It was claimed that, because some people they did not like Hilary Clinton or Donald Trump, they would vote for no one even though we know that there was a 90% chance African Americans were going to vote for Democrats. That was effectively a voter suppression campaign and was run out of Moscow, as far as the intelligence services can tell. We have an element of complacency in Ireland in this regard. Where a Border poll or future vote on EU constitutional issues is concerned, we are at serious risk. We would be slightly less at risk with this Bill, but we would not be fully there.

The Deputy asked how to ensure that a body like the one outlined in the Bill was accountable so that it did not just change the rules halfway through an electoral period. That is a difficult thing to ensure and I do not envy the legislative drafters who must try to sort out that puzzle. Speaking as a political scientist rather than a lawyer or legislative draftsperson, the best approach is to have a tightly defined set of outcomes that we want the electoral commission to achieve, a defined set of powers to be able to achieve them, and proper checks and balances, for example, a requirement for setting rules six months before an election based on an assessment of the latest developments in campaign technology. Those rules would then have to go before a committee like this one or some other accountable body. It would be important for the commission to have the statutory power to compel private companies to take certain actions, in particular around transparency measures. Outside the realm of hate speech or other such concepts, it is dangerous to give anyone the power to compel the taking down or removal of content from a freedom of expression point of view, but the commission should be able to go to a company that has a new product it had not anticipated and tell the company that, at a minimum, it must publish information on who is giving it money, who is spending, etc.

Chairman

I thank Ms Carolan. Is Deputy Higgins or Senator Seery Kearney next?

Senator Rebecca Moynihan

It is actually me. I had to pop out.

Chairman

My apologies. I did not realise that Senator Moynihan had returned. I was skipping past her.

Senator Rebecca Moynihan

I have only just returned. I missed a portion of the meeting, so I apologise if I ask a question that someone has already gone through. I will be quick.

Ms Carolan's presentation was interesting and this is a fascinating area. Something that she and academics like Professor Jane Suiter have said is that the body needs to be a campaigning and dynamic electoral commission. Deputy Cian O'Callaghan covered this matter somewhat, but if Ms Carolan had to choose one term of reference, particularly as regards digital advertising outside elections that the electoral commission would have to cover, what would it be?

Will Ms Carolan elaborate on her allusion to disinformation campaigns in, for example, health matters? They have an effect on the body politic, as well as on elections. Does Ms Carolan believe that this matter should be included in the electoral commission's remit outside of elections or am I picking her up wrong?

I will ask a brief question about the Data Protection Commission, DPC. I had a meeting with Facebook.

It spoke about the names and postal addresses of people being publicly available and stated it would be much better for the regulator to be able to hold that information. I do not currently have a view on this issue, but do the representatives of the Data Protection Commission think that head 121 conflicts with the GDPR?

Ms Liz Carolan

I will jump in on those two points. If I had to choose just one provision, I think it would be having full transparency of all advertising, ideally, but perhaps with the exception of commercially sensitive advertising. That would enable us to do some of that forensic work and actually assess and understand what is going on in terms of advertising.

On the issue of disinformation campaigns, I do not think the electoral commission should have responsibility for disinformation campaigns that go beyond the realm of elections or potentially into things such as trust in institutions and the integrity of the broader democratic system. It having responsibility for matters relating to health would muddy the waters somewhat.

Mr. Dale Sunderland

I too will come in on the point regarding head 121 and whether it conflicts with GDPR. I do not think it conflicts with GDPR, per se. It is about the balancing of rights and what is trying to be achieved. One must determine whether the purpose that is trying to be achieved justifiably outweighs the other rights of individuals. Transparency is a key objective. If that case is well made and it is determined that there is a justification, due cause or proportionate and necessary reason for publishing those details, that can meet the standard under the data protection requirements. In doing so, one identifies the risks and the mitigations of those risks. If the data were to be published, they would be published with safeguards such as, for example, that they would be non-searchable and there would be measures to prevent screen scraping. It is about assessing the risks and putting the safeguards in place and then that balance between transparency and personal privacy. I cannot give the Senator a definitive answer because it is about weighing up the intrusion into the individual's personal data and his or her right to privacy compared with other rights and freedoms and legitimate public policy objectives. That is the determination that would have to be made.

Obviously, the platforms would have obligations to ensure the data are secured and a whole suite of obligations in terms of complying with the GDPR if they are required to publish this information under legislation.

Deputy Emer Higgins

I thank Ms Carolan and Mr. Sunderland for sharing their expertise with the committee. It has been really useful for me to hear their perspectives. I am sure other members will agree with me. My view is that this legislation needs to be very well proofed. It needs to be future-proofed from a technological advancements perspective and it needs to be accuracy-proofed to ensure we protect the integrity of the register of electors.

The Office of the Data Protection Commission identified three sections of the Bill in respect of which it considered impact assessments were needed. This may be a bit of naive question but is it not too late to start those impact assessments after the legislation is passed, if it is passed in its current form? What can be done in advance of that? What information could the witnesses provide to the committee in advance of that to give us a bit of comfort that such impact assessments would be possible, were we to go ahead with the Bill?

As the Fine Gael spokesperson on social media, I am hanging on Ms Carolan's every word. She is sharing not just her passion, but also a significant level of expertise in the online sphere. I agree that we need this legislation to be able to predict, assess and react to threats. I would value her input in terms of how she thinks the legislation could be amended or updated to allow for that. In her opening statement, she referred to astroturf campaigning. How could that be incorporated into the Bill?

What I have taken from her submission are three big items. The first is around the real-time online advertisement bank. From my perspective, we need to regulate both the advertisements and the money and funding behind the advertisements. Ms Carolan's comments are really interesting in terms of an international interference perspective. That is something on which the committee probably needs to do a bit more work.

She spoke about needing to go beyond the election period. That is a matter the committee has discussed on several occasions. It is just a matter of checking to see what is appropriate within the Bill, given that it is more about the election process itself. She also spoke about the political purposes and the definition thereof. I would certainly be interested if she were able to follow up with a written note on that in terms of how she believes the committee could incorporate or update it.

On the issue of advertisement libraries to which she referred, it seems to me that what she is saying is that the advertisement libraries were set up as a fix for the US. We have a very different system and political culture from those in the US. That is quite true when one looks across Europe as a whole. The fact that so many of the online social media platforms are headquartered in Ireland from a European perspective gives us a really good opportunity to ensure we are getting an Irish fix and a European fix for that as well. I would very much welcome the views of Ms Carolan in that regard.

Mr. Dale Sunderland

I thank the Deputy for her questions. She asked about the data protection impact assessments, DPIAs, and whether it is too late at this stage to carry them out. The first thing to say is that the Department is currently carrying out a DPIA. We can look at it in a few different ways. We can look at the systemic overall issues with the project. That should be done now, at this drafting stage. It is important for that process to continue prior to the Government signing off on the final text of the Bill. That can be done at this stage. Issues around personal public service numbers, PPSN, other risks around the national register, how it will interface with the local registers, the registering authority etc. can all be dealt with. One can then look at subsets of that when it comes to implementation. The online infrastructure, public portal and all those things can be looked at in separate data protection impact assessments, which we certainly recommend. For example, commencing the new provisions around pre-seeding the register and things like that can be looked at in further data protection impact assessments after the Bill is enacted. A data protection assessment is always a living document and should be continuously reviewed and updated as necessary.

Finally, as I mentioned in my opening remarks, Article 36, which is the statutory requirement under the GDPR for public authorities to consult the Data Protection Commission on draft legislation, has not yet completed. We will continue to engage with the Department and provide our views.

Ms Liz Carolan

On the Deputy's final point regarding values in Europe versus those in the US, I would add to that around political advertising that my colleague, Ms Wade, spends a significant amount of time working with various European colleagues and they are constantly looking to Ireland for regulation around political advertising because it is possible that the country of origin principle will apply such that whatever we introduce in Ireland could end up being de facto legislation for the whole of Europe. That is another matter for the committee to bear in mind.

In terms of the political purposes, I strongly recommend that the committee speak directly to the ICCL, because it has done a significant amount of thinking on this issue and has published its views. Its statement is linked to in the footnotes of my written submission. I highly recommend speaking to the ICCL. It has spoken quite a bit about how these issues mesh and I agree with its views in this regard.

In terms of how the legislation can be amended, I and some colleagues, including some of the academics to whom the committee has already spoken, are in the process of working on a paper on this issue. That has been slightly hampered by me having a baby in December and being on maternity leave.

Deputy Emer Higgins

Congratulations.

Ms Liz Carolan

I thank the Deputy. I have not had the brain power or the childcare in the Covid era to write some of these things down. It feels a little bit like I am coming before the committee with more problems than solutions but there are organisations, such as the International Institute for Democracy and Electoral Assistance, IDEA and the International Foundation for Electoral Systems, IFES, that do a significant amount of thinking about structuring electoral commissions.

I think we are the envy of the world to be starting from scratch in the digital era. We are not trying to retrofit or deal with digital issues in the context of an existing body. We are going to build this from scratch.

Chairman

The Irish Council for Civil Liberties has written to us with a submission, which we will take into account as we prepare the pre-legislative scrutiny report on the Bill.

Deputy Thomas Gould

I confirm that I am in Leinster House. I have spoken already during these meetings about issues I have encountered. Perhaps the witnesses will comment on them. I raised a case before the last election involving a young man I met who had turned 18 years of age. He was frustrated because when he turned 18 his children's allowance was cut off automatically whereas his name was not included on the electoral register. Could we partner up somehow to get more people involved? In parts of my constituency only 30% of people voted in the last general election. That means there is a major problem.

Much of the discussion today has been on having a secure and accurate register of electors. Society has changed. There are far more people renting in the short term and when they move, records are lost. I listened to the discussion on personal public service numbers. We have data from the Departments of Education, Health and Social Protection and we have PPS numbers. We have the capacity to create a highly accurate and secure system. I am keen to hear the thoughts of the witnesses on that.

How would Ms Carolan recommend or propose who would sit on the commission?

Mr. Dale Sunderland

I will speak first for the Data Protection Commission. My thanks to Deputy Gould for his questions. He mentioned the accuracy and integrity of the database. These are absolutely essential. That is in part what the proposed Bill is trying to achieve. I note that the Eircode system is in scope and is also a part of the data that may be collected. That is another element that the Department is suggesting may serve to help accuracy around the register.

Deputy Gould rightly suggested other data sets that other Departments may have to populate in some way the register and ensure its accuracy. That is a potentially conceivable solution but it raises other risks. We would need to set out explicitly in legislation how that would be done and what would be the uses of such data.

We also have to acknowledge that some individuals do not wish to be on the electoral register. That is a right people have. People may choose to participate in the democratic process or otherwise.

The issue for us involves looking at what is in place already, what is being added and how all of that will be addressed. The idea is to ensure the current registers are brought together into the central register and augmented with further data. This must be done in a data protection compliant way. That is why we suggested it may be useful for the Department and the committee to look at whether any further provisions would be required to help update the current registers when it comes to the enactment of the Bill. When Department officials were before the committee they referred to a public awareness campaign. I do not have any particular comment on that but it may be well worth considering, rather than simply relying on the broad data sharing provisions in the proposed Bill. It could be set out more explicitly in legislation how exactly the current registers will be enhanced. I am referring to people who are already registered as well as new additions to the register. I am unsure whether I have really answered the Deputy's questions but I am happy to respond again if he wishes.

Ms Liz Carolan

I am not qualified to talk about who should be on the commission. However, I note the United Kingdom Electoral Commission has a board at the top as well as a staff of 145. We should be looking at the new commission as a body with accountability at the top, while ensuring it is fully staffed and funded. That is important, as are the crucial considerations about the accountability structure at the top.

Deputy Thomas Gould

Many of the issues I queried I have have been addressed, especially in respect of online advertising. My thanks to the witnesses for their contributions.

Chairman

I might follow up on the question asked by Deputy Gould. It is one I put to the Department officials when they were before the committee. The heads of the Bill set out the principles for recruitment to the electoral commission. Do any of the witnesses have a view on whether the electoral commission should have someone with expertise in online information or information technology? Would that be beneficial or is it too prescriptive? It seems the body will have scope to bring in researchers to assist in its work.

How do we overcome the static design of the legislation to enable the electoral commission to be sufficiently agile and able to manoeuvre to stay up to speed as technology changes? We may commit something to legislation because the stakes are high and there is so much potentially to gain from influencing elections. However, once a measure is in legislation, people will be determined to find ways around it. How do we enable the electoral commission to have the necessary agility?

Ms Liz Carolan

I am getting all the easy questions. There was a question about qualifications. I know a previous head of the UK Electoral Commission ran another state body and was brought in as chief executive. That person was given responsibility for ensuring that the institution was functioning well.

What expertise will the body have? I think this will require the body to be able to hire from outside the Civil Service. It may have to be able to hire in people with specific expertise, in particular if there is a research function and a body responsible for ensuring that there can be threat protection. There may need to be some of that agility. We will need people who are literate in those areas or who, at a minimum, know the people who are literate in those areas.

How do we get away from the static design? This is the big question that I spend much of my time thinking about. It is well worth getting people who are experts in institutional design to help us to figure this out. Some of the examples I have heard about are in the area of environmental protection. I know the Environmental Protection Agency has three functions. One involves a public information division. There is a research function and another part implements legislation. We do not write legislation for every new potential environmental threat. We build bodies that are capable of responding in dynamic ways. The shift in drug policy in the past ten years has been interesting as well. We do not ban every substance. Instead, we think about the outcomes we want to see and how to build bodies.

The question is particularly difficult when it comes to elections because in a way there are many turkeys voting for Christmas if we think about some of the standard accountability structures where our elected representatives are also candidates. However, I believe we have to pursue this and think about that question. Otherwise we will end up struggling as our European counterparts are at the moment. We want to avoid struggling in two to five years' time to adapt an institution that was built for a different age. We may have detailed legislation on political advertisements but we might not have thought about what will happen with Alexa or the next generation of programmatic advertising that cannot deal with AstroTurf campaigns, etc.

Chairman

What is the leading country in oversight of political advertising or legislation to address it?

Ms Liz Carolan

Believe it or not, in Europe this Bill is about as good as it gets. Sorry, my brain has gone. There is currently a piece of legislation at the European level and I will find the name and follow up. They are doing some thinking about political advertising but there are not many countries that are doing this well.

The UK Electoral Commission, which was only set up in the 2000s, has already issued numerous reports saying how it needs greater flexibility and greater powers to be able to respond and adapt. They have some really good provisions around the publication of expenditure data after elections which helps because it includes some political advertising spending data.

This is a part of our problem. Unfortunately, we cannot copy and paste from another country. Many other countries are looking to us as the headquarters for many of these companies.

Chairman

I thank Ms Carolan.

Senator Victor Boyhan

I thank the witnesses. They have raised some important issues. Many of the questions have been asked and I am conscious of time. I will focus on one particular issue.

First, I refer to heads 86, 101 and 104, which deal with the registration of electors of no fixed address, anomalous electors and pending electors. One will note in those provisions there is this issue of registration, etc. What is particularly important is that paragraph 19, page 3, of the deputy commissioner's submission to the committee today states:

It is noted that the establishment of a list of pending electors will require the processing of the personal data of children. The DPC has advised the Department [I would be interested in that advice] to take account of our recently published draft guidance titled, Children Front and Centre: Fundamentals for a Child-Oriented Approach to Data Processing.

This is of serious concern. I would like the deputy commissioner to tell the committee the main recommendations of that document because I think they are important. It is a particularly sensitive area, and one we must be cognisant of in relation to this proposed legislation. I will give my time to the deputy commissioner to tease out and explain to the committee some of the fundamentals. I read some of this document today but I would like the deputy commissioner to set out his understanding of it. The centrality of that document is particularly important as part of this process.

Mr. Dale Sunderland

I thank Senator Boyhan for his questions. The Senator raises an important point. It is tangentially addressed in this proposed Bill on the registration of pending electors.

To give the Senator some brief background, late last year the Data Protection Commission published draft guidance around the protection of children's personal data - Children Front and Centre: Fundamentals for a Child-Oriented Approach to Data Processing. That is out for public consultation at present until the end of this month. In large part, it looks at online platforms, as one would expect given that we are the lead supervisory authority for many of the giant technology firms, but in all contexts of the processing of children it sets down fundamental requirements. The General Data Protection Regulation, GDPR, calls out children as a special subset of individuals which deserve the highest protections of standards of data protection and we acknowledge in our guidance that under the age of 18 is the age at which a person is determined as a child in line with the definition of a child under the UN Convention on Human Rights of the Child. Given that the registration of pending electors will involve the crossing of personal data of children, that is, persons under the age of 18, we advised, as the Senator states, the Department that it should consider our draft guidance and to look and see which elements of that might apply.

Of particular relevance to this registration process is a recommendation that in implementing the legislation there would be an audience-aware approach to the provision of clear and targeted information. The legislation, in a sense, probably is what it is. It is a question as to whether further evolving of that in the drafting is required but what is of critical importance will be the implementation of that provision. I understand, from the heads of the Bill, that the registration of pending electors would be done on the basis of applications by maybe 16-year-olds or 17-year-olds, and that the Department has talked about running certain programmes to involve children in the electoral process to get them engaged. Those are all public policy imperatives, but what we are calling out is that one must remember where the processing of personal data arises that one is dealing with children and, therefore, the information should be targeted in a way that is appropriate to their age. It applies to adults, but most particularly applies to children, and must be concise, transparent, intelligible and accessible.

It is also to make the point as well that we suggested a data protection impact assessment - I mention it again - should be carried out for this specific cohort of persons and address any additional safeguards that might be needed. I do not have a deep insight into what they might be at this stage other than, I suppose, a general warning that when one is processing specifically the personal data of children it is important that any risk to their rights is identified and addressed.

Further on, there is also potentially the issue of their rights under the GDPR and the different rights that may apply, such as the right of access. In the implementation of these provisions there would need to be deep thought around how that would apply because, in some cases, parents may, for example, submit an access request on behalf of a child. At that age, the child has probably reached an age of maturity where he or she should be able to exercise his or her own data protection rights, but it is a sliding scale. I am probably going a little off point.

Our core point in raising that was that the Department would be aware it will be processing children's data in a specific context, albeit at the request of the child. The core issue for us is around the transparency of the information to the cohort of people, clearly explaining what it means to engage in this way of putting one's details on the electoral register before one turns 18. I will say straight up that there may not be extensive risks but it is important that there be a specific focus on the matter to identify and mitigate any risks that are there to the rights of the children.

Chairman

I thank Mr. Sunderland. I apologise for skipping over Senator Fitzpatrick. The Senator should have contributed before me that time.

Senator Mary Fitzpatrick

That is fine. I thank the Chair. It was not a problem.

It has been an interesting meeting. I thank Mr. Sunderland and Mr. Murphy, and Ms Carolan, for their contributions. They are really helping us.

I agree this is a hugely important draft piece of legislation. I suppose democracy is up there for us with the rule of law and human rights and we must get this right. Their contributions have helped us progress the discussion but they have probably raised more questions for us which we, as a committee, will have to take on in the next stages of our work. I direct that comment, I suppose, to us as a committee.

Specifically, in terms of the Data Protection Commissioner, the deputy commissioner, Mr. Sunderland, referenced on a number of occasions the data protection impact assessments. I completely agree with him, in terms of a methodology and a practice to assert and to establish, but can he go back to the question I heard one of the other committee members ask earlier? It seems counter-intuitive that these data impact assessments would be done after we have enacted legislation, particularly as it relates to the register of electors. The integrity and the accuracy of the register of electors is fundamental to any chance of our democracy being an effective democracy.

Can the witnesses talk about that? I have an intuitive concern, which is not based on any great expertise, around the proposal to have a central database and, for a period of time, a parallel local authority-administered register of electors. At base, before we embark upon creating any sort of new centralised database there should be some sort of audit of the integrity of the existing database and register and a data protection impact assessment undertaken on what is being proposed.

I congratulate Ms Carolan on her baby. It is a terrible time of the evening for us to ask any mother with a young baby to engage in these types of meetings. I appreciate her attendance. Her contributions have been really valuable.

I refer to the electoral commission. When I think about the architecture of the register it is something we have to get right at the start. For the commission to succeed it has to be something that is future proofed, scalable and adaptable. It cannot be static and must be something that evolves. What type of resources should we be looking to secure in the initial stages in order to do that?

I heard what she said about there not being an exemplar. I appreciate the reference to the European democracy action plan. We need to try to protect the democratic value of our electoral process, as opposed to defining the nuts and bolts of how we are going to do that. I would appreciate any guidance or suggestion she can give us on how to progress that objective.

Mr. Dale Sunderland

I thank the Senator for the questions. I welcome in particular her comments on the importance of the data protection impact assessment, which we see as being central to this process. On the question of whether it is too late once the Bill is enacted to carry out a data protection impact assessment, for some elements it certainly would be. That is why the Department is undertaking a data protection impact assessment of the project as a whole and all of the key elements.

We would certainly be of the very strong view that before the provisions of the Bill are finalised a very detailed data protection impact assessment should be conducted of all of the main elements of the Bill which involve the processing of personal data. I have mentioned PPS numbers in regard to a holistic overview of the central register and how those issues around the engagement between local registers and the central register can be addressed prior to the enactment of the Bill in order to tease out what the issues are and how each of those elements will comply with data protection requirements, in particular the risks that will arise.

The Senator mentioned discrepancies. I agree with her and it is a point I called out in my opening statement. There is some detail that we at the commission do not fully understand yet in terms of how it is going to work in practice. That is why we are anxious to continue our engagement with the Department through the Article 36 prior consultation process in order to find out further detail, see the draft data protection impact assessment and provide our views on it.

The point I was trying to make was that some elements of the project such as, for example, the technical details around establishing the national register, the technical elements of safety and security and how it will work in practice could be teased out after the Bill is enacted. There is a two phase approach.

The Senator also mentioned an audit. At some stage that might be a very good idea because it comes back to the heart of what the current problems are, what are we trying to solve and how we are going to solve it. We then need to make sure that from a data protection point of view the solutions the Bill seeks to provide actually address the issues satisfactorily and in the appropriate way.

That is probably enough from me on the Senator's questions, unless she wishes to follow up. I am of course happy to answer further questions if required.

Ms Liz Carolan

In terms of resources, if we want a fully functional research function and the ability to commission research on top of that, not just post-electoral surveys but also risk assessments, staying in touch, active communications around voter engagement, etc. that would require a staff of 30 or more and a decent operational budget. It would also potentially require a policy-making function. I fully agree with the points the Senator made on what we need in order to succeed with something which is scalable and adaptable.

I am not a lawyer. I have seen 300 pages of detail, yet I cannot see what success would look like. There is no definition of the outcomes that we would want an electoral commission to deliver. We are trying to get into details before we have a headline document which states what the electoral commission is for, what success will look like, what we want to achieve and the values we to want to implement. We have a lot of detail about appointments and various bits and pieces, but there is zero mention of voter suppression in the entire document.

I do not feel I am able to tell the committee the ten amendments that can fix the 300 page document. Stepping back and asking what success would look like and what institutional structures that could deliver that for us would be helpful. I am happy to continue supporting the committee in any way that I can. I can recommend some international experts who may be able to contribute.

I am delighted to get away from my baby.

Senator Mary Fitzpatrick

A woman after my own heart. I thank Ms Carolan. That is great. I ask her to send on the recommendations if she can. The committee can consider how we take this piece of work forward. That information would be very welcome.

Mr. Dale Sunderland

I have a brief further comment. It has just occurred to me following questions from Senator Fitzpatrick and others that the electoral commission will be a safeguard in terms of its oversight responsibilities and responsibilities to ensure the integrity and accuracy of the database. We should not lose sight of the fact that there will be an body responsible on an ongoing basis for making sure that these things are done in the right way. We see that, and the Data Protection Commission, as a further safeguard, in addition to all of the other pieces that make up the full picture.

Chairman

I thank Mr. Sunderland. On the other experts who may wish to contribute, we are in a position to take written submissions on this. I do not think we will be in a position to hold further meetings, except for the one we have already organised, but we will take written submissions.

Senator Mary Seery Kearney

Given the state of the current electoral register, I would be quite frightened about the fact that we are in charge of a database that is wholly inaccurate and are administering a database that is wholly inaccurate, contrary to a lot of the provisions of GDPR. It is urgent that we address the requirements to make sure that the basis of our democracy is actually accurate.

I would be a supporter of a PPS number being an identifier for a number of reasons already stated by colleagues in this meeting. It is adaptable for people of no fixed abode. It lends itself to uses in all sorts of different circumstances, whereas an Eircode is limited. However, I can understand that it is useful in rural areas in terms of accuracy.

I come at this from the perspective of a practitioner in privacy law and a serious fan of GDPR. However, coming back to the point made by Deputy Gould earlier, I believe GDPR can be used as a weapon for people to do as little as possible and evade their disclosure requirements rather than as a rights-based approach which it what it is.

GDPR is about our entitlements in regard to the control and use of our data. In that context, I am curious about the terms of use when an individual signs up to a social media platform of any sort. In a sense, that is a contract that the individual signs up to and the use then is prescribed by that contact, for example, in relation to political advertising, influencing and the various others uses about which we spoke earlier, including astroturfing, although I am not sure that the public in general would understand what that is. I refer to marketing or public relations campaigns being manipulated in the guise of unsolicited comments or a proliferation of views and opinions being used to give the impression that a particular opinion is supported. When augmenting and amending their terms of service, do the social media platforms put in data processing impact assessments, DPIAs? Do they supply DPIAs and who is overseeing their community standards? Do we have an entity that is doing that?

I am concerned to hear Ms Carolan say we are seen to be thought leaders when it comes to this legislation because, for me, there is a massive gap in it in that our society has changed fundamentally because of social media and we have not caught up with it. We are not even aware of the extent to which our daily lives are influenced by social media and we have become so used and addicted to the convenience and connection of it that we do not realise how much we are being influenced and changed and our very thinking is being augmented without us knowing it. I am interested in knowing how the artificial intelligence, AI, works and how the community standards are being applied. Who is the overseer in that regard? The term "political advertising" as defined or inferred in the Bill is too narrow. It is too short a space of time, in my view. That section of the legislation, in my view, is not fit for purpose and is not forward-thinking enough.

I see some sort of interplay here for, perhaps, a social media commissioner. I have looked closely at the media commission. All that is proposed there is fantastic for a specific purpose. The Data Protection Commission too is fantastic. I am a big fan. I am always very proud of Helen Dixon when she is speaking at international events and of how much we lead on this, but it is a fixed purpose also. The electoral commission will have a very confined purpose as well. How do we take the three elements of those that need to come together such that we can oversee that our whole way of thinking is being influenced and changed all of the time on platforms and yet we are unaware of it? How will that be managed, still allowing for freedom of expression but at the same time dealing with the phenomenon of disinformation? I could speak for hours but I will stop now otherwise there will be no time for answers.

Chairman

I invite Ms Carolan to respond.

Ms Liz Carolan

I would love to solve all of those problems. It is my job to try to ensure that we can, but many of those issues have to be dealt with at European level. I do not believe Ireland has the weight as a single country to do it, but the US does. The European Democracy Action Plan and other initiatives are looking at that broader picture. If we try to move too far beyond influence on electoral processes not only will we get ourselves into trouble, but we could end up discrediting the electoral commission if it ends up getting into arguments and fights about, for example, health disinformation, as mentioned earlier. It could be maligned in that way.

When it comes to terms of use and community standards, they will always refer within them to compliance with national laws and that those laws have precedence over the terms of use and community standards. This is why we need to make sure that the electoral commission has legislative powers to be able to mandate, in particular, transparency measures on platforms but not just related to political advertisements. As new technology evolves, having that written into legislation will be important. We can shame individuals who run the large companies but in five or ten years that may not be Facebook and Google. Who runs TikTok, never mind Gab and all the other platforms that are increasingly taking part of the communications? Staying in a particular lane is the pathway to making sure we have an institution which is trusted. Hopefully, Europe will fix it.

Senator Mary Seery Kearney

If we stay in a particular lane we are going to be narrow and not face up to the reality. The reality is that disinformation is affecting the roll-out of the vaccines. Ms Carolan would need to see the type of emails that public representatives get on a daily basis, where people are being quoted as authorities that they are not, or they have a vested interest in disinformation. That is affecting our electoral process. It is affecting our democracy all of the time and there does not appear to be any body that is overseeing that.

Ms Liz Carolan

The media commission will, hopefully, have a role in that regard and, hopefully, Europe, but it is really piecemeal and it is really difficult.

Chairman

Would Mr. Sunderland like to comment?

Mr. Dale Sunderland

Yes. I thank the Senator for her questions and her comments about the Data Protection Commission. We do not have many fans. I am delighted the Senator is a fan. She mentioned that GDPR is often used as a reason for not doing things which, to be honest, very much irritates us because that is a deflection from the purpose of data protection.

The Senator also mentioned the platforms and raised a very valid point about the role of regulators. The Data Protection Commission is only responsible for regulating the use and processing of personal data. In regard to online content and moderation of content, including illegal content and harmful content, that is another sphere entirely in which the Data Protection Commission is not involved. The gap and lacuna that leaves is a matter beyond the Data Protection Commission, but is a fair comment.

In terms of the platforms, the Senator is correct that they vary in terms of their lawful basis processing under Article 6 of the GDPR. Some of them rely on contract and others rely on consent. There are a lot of complexities there but on that point I would point out that we have a number of ongoing inquiries looking at the lawful basis on which the online platforms process personal data in the context of a user signing up. One of those, which we reference in our recently published annual report, is in relation to Facebook and its reliance on the lawful basis for processing.

The issue around community standard is separate to data protection. It includes data protection but it is more large-scale than that. It is about all the issues around online content and what they allow on their platforms but there is a nexus at certain points. Where they are introducing new types of data processing or changing the way in which they do things, the platforms have to undertake a screening to see if there is a high risk to the data protection rights of individuals. Where they identify a high risk - I would imagine anything to do with processing around elections may fall into this space - they have to do a data protection impact assessment. Even if they are not required to do a data protection impact assessment, there are other obligations they must comply with, including the principles of data protection such as that the processing is fair, lawful and transparent and they only use data for the purposes for which it was collected and so on. It is really complex in terms of these platforms and the way they are structured. However, these are issues the Data Protection Commission is incrementally looking at as we work through our various inquiries and in other areas such as our supervisory function where we engage with the platforms on a regular basis around new products and services.

Members might have heard last year the example of Facebook dating and how the Data Protection Commission intervened in the process to review the data protection impact assessment. It secured changes on the back of that in terms of transparency for individuals regarding how data would be used in Facebook dating, for example. All those changes helped in making recommendations to Facebook to make sure it was compliant.

In this space, online advertising is obviously a big issue. We have open inquiries into how the online ad tech system works. There is an inquiry into the Google Authorized Buyer organisation and another into an organisation called Quantcast. This is all looking into and teasing through all the things that happen in the background concerning how data are collected in online and offline contexts, how they are merged and how they are resurfaced to determine what advertisements members and I might see, depending on how we browse or what we like online. All of that is very much in play at the moment. It is not the answer to all of these issues but it certainly has a part to play in the overall picture of working out what compliance means under GDPR and the standard expected under GDPR. That work is ongoing.

Chairman

I thank Mr. Sunderland.

Senator Mary Fitzpatrick

I wish to follow on from the previous contribution. When we focus on advertising in the digital environment we are kind of ignoring the elephant in the room. The Internet is on 24-7 and it is available in the palms of everybody's hands. It is the corrupting and corrosive effect of digital influencing on our democracy that we need to be trying to tackle. We need to try to protect the democratic process. We need to be realistic about the levels of control that can be exercised but, at a minimum, we should be exposing the very tenuous relationship that some political actors have with the truth. Does the delegation agree that if we are to invest in an electoral commission to try to protect the democratic value of our electoral activities, its remit should really cover monitoring, examining and reporting beyond the election cycle? The reality is that influencing is occurring increasingly outside the election cycle and not through advertisements. Every other form of digital communication is being used. Do the delegates agree that the remit of the electoral commission should not just be limited to the electoral cycles and that the commission should have a remit on an ongoing basis?

Chairman

Is that question for Ms Carolan?

Senator Mary Fitzpatrick

Yes.

Ms Liz Carolan

I thank the Senator. Our existing electoral laws have three values that we care about. The first is that we limit money, the second is that we limit the franchise, and the third is that we demand openness, traceability and scrutiny in political campaigns. We do not live in a world where we can apply that for the eight or 12 weeks before an election, nor do we live in a world where we have X number of political parties and some Independents who are the only actors participating in the run-up to elections, never mind referendum campaigns. What the electoral commission could do, at a minimum, is enforce the openness and traceability piece in online discussions that happen all the time. I am referring to transparency not only in political advertising but also in all other advertising. There are many grey areas. For example, if one is selling feminist T-shirts, does that count as political activity or commercial activity? One can get into very murky territory. The more one imposes limits, however, the more one is just penalising the good actors and then keeping the bad actors and their activities hidden. I would like to see the electoral commission having a mandate and the ability to enforce openness and transparency on platforms. We cannot rely on their goodwill, especially when we do not know what the next big thing is going to be, or the big thing after that.

Advertisements are an issue because they are about money and financial transactions. This is something we regulate. The Internet is toxic; it is awful. It is an awful place. We need to be investing in public service broadcasting because we know that matters. It matters that people have reliable sources of information to counter bad information. If one spends too much time focusing on how to deal with the bad information and not enough on how to counter it with good-quality information, it is an issue. There are a few organisations internationally, such as First Draft and Data & Society, that have done some really good research on this. That is important.

Chairman

I thank Ms Carolan.

Deputy Eoin Ó Broin

I will make a very brief comment and then ask a question to Ms Carolan. Let me end on a positive note because a lot of this is about regulating and dealing with the negative stuff, the social media and material on the Internet. It is important to emphasise that the Internet, as well as being a toxic place at times, is a very strong, powerful and empowering place, which is why we all use it in our work to promote our activity. It gives people access to large volumes of good information that they would not otherwise have access to. We need to balance those things. I remind people that if they want a lot of disinformation, they should not go to the Internet but sit in the Dáil Chamber for a few days. They will hear a lot there. Often the sources are some of the political actors who most loudly complain about these matters. I am not talking about people present but people more generally.

Industry representatives will be before us next week. If Ms Carolan were in our shoes and had the opportunity to ask them some questions in the context of this legislation, what would she ask them? What should we watch out for in the responses they are likely to give? There is a quite strong cross-party consensus to the effect that we would like the section of the Bill in which Ms Carolan is interested to be much stronger which, of course, a committee can achieve by way of amendment. I presume the industry will resist some of this. What would Ms Carolan ask the representatives, and what should we be looking out for?

Ms Liz Carolan

I thank the Deputy. I get asked to speak about this issue at various times and there are often representatives of platforms present. I always find it interesting how much time we spend asking people how they would like to be regulated in this domain. In other domains, it does not happen quite so much. How can our interpretations of the kinds of values we want to have in our democracy, which we have been talking about for the past while and which include the regulation of expenditure and provisions on transparency and access to information, be applicable in a context where there are private companies trying to create rules that will apply in 216 countries? I can empathise a lot with the platforms because they cannot do as I describe. There is no way to design the perfect advertisement archive that is going to fit with regulations that are popping up in over 200 countries. I am not entirely sure of the answer. I would be interested in hearing the members' goals in talking to the platforms. Is it to ask them what realistic regulation would be?

Is it to get ideas from them? I always find it tricky to figure out how to bring the subject of regulation into discussions and what our goals should be in that regard.

Chairman

That brings us to the end of the session. I thank Ms Carolan, Mr. Murphy and Mr. Sunderland for their attendance and engagement, which has been very helpful.

The meeting is adjourned until 9.30 a.m. on Tuesday, 30 March, when we will recommence in public session to carry out further pre-legislative scrutiny on the electoral reform Bill with representatives of social media organisations.

The joint committee adjourned at 8.30 p.m. until 9.30 a.m. on Tuesday, 30 March 2021.