The Data Protection Commissioner has said she has concerns about the risks associated with the Minister of Children taking over as Data Controller of the archive of evidence given to the Mother and Baby Homes Commission when it is dissolved as expected on Sunday.
Speaking on RTÉ's Today with Claire Byrne, Helen Dixon said her office has been in almost constant contact with the Commission in recent weeks, and has been engaging with particular urgency about the redaction of the identity of witnesses who have requested this, and whether that will be done before the data is handed over to the Department.
There are a lot of risks with the archive the Department is taking over "in terms of a lack of expertise and familiarity with the archive," she said.
"They need to ensure they have mitigated all the risks, and as they start to ensure for the exercise of rights they have to ensure that they take account of the rights of third parties that may equally be affected," she added.
To date, Ms Dixon said her office has received 15 complaints from individuals, and some have been about rights of access to evidence and some have been complaints about the deletion of audio files.
On whether it would be helpful for the lifespan of the Commission to be extended the Data Commissioner said that is a political issue.
She said the Commission, having investigated for five years, "are the experts in its own archives" and so the Department of Children need to "quickly mitigate high risks" in taking over "an archive of this nature".
"We understand from the department, that it believes that 100,000 documents 900,000 pages and 120,000 persons may be referenced in the archives that they're taking over and so our concern at this stage is the need for the department to quickly mitigate what are high risks in taking over an archive of this nature".
Ms Dixon said it is important that the Department of Children understands the factors that the Commission considered when it decided to delete the recordings of witness testimonies.
She said these factors may still be "at play".
"There has been controversy about the deletion of the audio recordings and so for the department in taking over the full archives, it's still important that they have a clear understanding of the factors the commission considered when it decided to delete the audio recordings," she said.
She added: "Whether it's right or wrong that they deleted them and all of the circumstances and clearly there are big question marks. The transparency appears to have been lacking to the witnesses from what we know.
"It is extremely important that they understand the factors that the Commission considered because some of those may still be in play."
Ms Dixon said it is a concern of the DPC that there may be issues around rights of third parties that were accused in the testimonies.
She said this must be "factored in the due process to give effect to rights of all persons referenced in these records".
She highlighted that the DPC is engaging with the Minister and the Commission on the redactions of the audio recordings, as per the choice of some witnesses, before they are transferred to the Minister.
"We're engaging with the Commission and the Minister on as a matter of urgency, the issue of Section six of 2020 Act that was introduced last October, because of course the purpose of Section six was to give witnesses to the confidential committee a choice about having their identity redacted in the archive that was transferring to the Minister."
She added: "It's unclear what is happening with the audio recordings, given that it's the role of the Commission to implement redaction of the choice of the witnesses, is the Commission implementing redactions of the audio recordings of the 75 to 80 people that have requested it before they transfer the audio recordings to the Minister?"
Ms Dixon pointed out that it is not the role of the DPC to "sort out" the handling of the archive procured by the Commission of Investigation, but she said the DPC is "intervening extensively" to ensure that the risks in handling an archive of such a sensitive nature are mitigated against.
"The accountability under the GDPR is on the data controller, so it's on the Commission, it's on the Minister and it's on the Department.
"I have to be clear it is not the role of the DPC to sort it out, but of course we're intervening extensively here to try and ensure the controllers are accountable, and take the actions, they need to sort it out and mitigate the risks. And this is a challenge here the clock is ticking down."
"If it is the case which that the Minister and his Department are the controllers from next Monday, there are a lot of risks around this archive that they're taking over, in terms of lack of expertise and familiarity with the archive and they need to ensure that they have mitigated all of the risks, and that as they start to allow for the exercise of rights, they have to ensure that they are factoring in the rights of third parties."