Tag Archives: Data Protection Commission

Minister for Employment Affairs and Social Protection, Regina Doherty, T.D. speaking at the budget 2020 Press Conference in Government Buildings; Department of Justice press conference this morning

This morning.

It was thought that when the Minister for Finance Paschal Donohoe delivered Budget 2020 yesterday, no increase in funding was announced for the Data Protection Commission – which may soon be facing the State in court.

In light of this, solicitor and data protection expert Simon McGarr tweeted this morning:

“Greyhound racing gets an increase on €16m funding. The entire 100+ staffed DPC office gets €15.2m, no increase.

“For some reason the Dept in charge of the Public Services Card project didn’t increase funding for the regulator, despite huge work increase post-GDPR.”

However…

Irish Independent journalist Hugh O’Connell, at a Department of Justice Budget 2020 press conference this morning, tweetz:

For those asking, the government’s funding for the Data Protection Commissioner’s office is up by €1.6m next year.

Total budget of €16.9m for 2020.

The Data Protection Commissioner Helen Dixon recently found there is no legal basis for the State demanding the use of the Public Services Card in order to access a range of public services beyond social welfare payments.

Ms Dixon ordered that Minister for Employment Affairs and Social Protection Regina Doherty’s department stop issuing new PSCs, with immediate effect, to people seeking a service outside of her department.

She also ordered that the department delete the supporting documentation – such as utility bills, etc – that the department has retained on the 3.2million card holders.

Ms Doherty is categorical her department will not be complying with these orders and has said the State will challenge the findings of Ms Dixon – in court, if needs be.

This morning…

Cianan Brennan, in The Irish Examiner, reported:

“The Department of Employment Affairs and Social Protection did not share the interim adversarial findings of the Data Protection Commissioner (DPC) regarding the Public Services Card (PSC) with any affected bodies apart from the Department of Public Expenditure and Reform.

This was despite being specifically asked and in a position to do so.”

Social Protection slow to share draft report on PSC (Cianan Brennan, The Irish Examiner)

Meanwhile…

The Irish Council for Civil Liberties has launched a petition calling for the card to be stopped and for data retained to be deleted.

The petition can be signed here

Related: Twitter and Facebook could be facing billions in fines after Ireland investigations (CNBC)

RTÉ’s Mary Wilson; Minister for Employment Affairs and Social Protection Regina Doherty and Minister for Finance Paschal Donohoe; Public Services Card

Last night.

On RTÉ’s Drive Time.

Minister for Employment Affairs and Social Protection Regina Doherty was interviewed by Mary Wilson following the publication, by her department, of the Data Protection Commission’s report into the Public Services Card.

Before their interview began, listeners heard a clip of an interview the Data Protection Commissioner Helen Dixon had with RTÉ’s Miriam O’Callaghan last month – during which Ms Dixon spoke about what the DPC had ordered Ms Doherty’s department to do.

These orders included that Ms Doherty’s department had to stop issuing new cards, with immediate effect, to people seeking a service that’s outside of her department – and Ms Dixon asked that the department write to her within 21 days to outline how the department carried out that order.

The DPC also ordered that the department delete the supporting documentation – such as utility bills, etc – that the department had retained on the 3.2million card holders. Ms Doherty was to write to Ms Dixon about that within six weeks.

But last night, Ms Doherty was categorical that her department will not be complying with these orders.

From last night’s interview:

Mary Wilson: “You heard what the Data Protection Commissioner said there. She said that on the 16th of August. Have you complied with all of those directions?”

Regina Doherty: “Well, I think, as is on the record, we took a number of weeks to consider the votes, the letter that the commission sent us and the report with all of its eight findings. And the simple and short answer to your question is ‘no’. Because we don’t agree with any of the eight findings and we have written to the commission to outline that.”

Wilson: “So, where to now?”

Doherty: “Well I suppose the position is that we’ve made, we’ve reacted to the instructions that the Data Protection Commission gave us in the letter of the 15th. We’ve requested a meeting, on a number of occasions, to see if we could establish. There are some inconsistencies with regard to the findings and the instructions in the letter and some of…”

Wilson: “Like what?”

Doherty: “It’s kind of technical, it’s…”

Wilson: “Well, we need to get technical, minister then because this is a damning report on your department and the operation of the Public Services Card and your response is that you’ve got problems with some complicated issues or fair procedures.”

Doherty: “No, well, actually, that’s not what I said. And our response I think is very clear and unambiguous, in so far as that we disagree and the legal advice that we’ve obtained, from the Attorney General, is that we have an incredibly strong legal basis to do exactly what was set out in the 1998 legislation, established in the 2005 legislation and amended thereafter in 2007, 2009, 2011 and 2013.

“And so we’re not trying to be ambiguous in any way, shape or form. Which is why we’ve been as transparent as we have been today – not only to publish the findings and the report from the Data Protection Commission but to publish the correspondence that’s gone on between ourselves and the commission since then.

“I’ll give you a small example of the difference between the findings in the report and the instructions in the letter.

“One of the findings in the report is that we, should not, under Data Protection law, retain data indefinitely. I’m not sure what the legal definition of indefinitely means but the instructions in the Data Protection Commission’s letter is that we have to immediately delete all of the data that we hold on people, even for people who’ve only got a PSC card last week.”

Wilson: “Supporting documentation, minister.”

Doherty: “That’s correct, yeah.”

Wilson: “Not the name, and so on, it’s the supporting documentation…”

Doherty: “So to be clear, Mary, that data set…”

Wilson: “…the data sent to get the card.”

Doherty: “The data set is entirely different to the supporting documentation and the discrepancy or the inconsistency is with regard to the supporting documentation. And that’s only one example. But unfortunately, we haven’t been able to meet with the Data Protection Commission staff and that’s why we are where we are today which is why we’re publishing the report…”

Wilson: “So, just to be clear before you move on. Just to be clear before you move on. You will not be getting rid of or eliminating or destroying the supporting documentation that you retain on 3.2million people who’ve received the card?”

Doherty: “No, Mary, because our advice is that it would be illegal and so if I acted as the directions in the Data Protection Commission’s letter has suggested, I would actually be contravening the legislation that underpins the practice and the policy as far as 1998 and that would be illegal.

“And that’s the advice that I have. And with respect to my role and my job, which is defending the delivery of services, in an efficient manner, to the public which we serve, we regard the legal basis underpinning this service to be incredibly strong.”

Wilson: “Will you stop any demand for the Public Service Card for the delivery of services other than welfare services?”

Doherty: “So, to say again, Mary. The eight findings, in its entirety, are not accepted by ourselves in Government and so we won’t be complying with any of the instructions with regard to the findings or the instructions in the letter.”

Wilson: “Spell that out for the public. When I go to apply for a passport now, are you going to ask for a Public Services Card?”

Doherty: “So, to spell it out for the public, in so far as 3.2million people in Ireland already have data, or PCS [sic] cards. Anybody that doesn’t have one is usually invited to come in and be registered under the SAFE 2 process and that allows them access. All of the public services across Government departments, on a once and done basis, and so what you would be suggesting that we do, is to go back and asking people to fill out forms in triplicate, across a number of departments…”

Wilson: “No, no, no. I asked a simple question: what are people to do now if they’re applying for a passport and they’re asked for a Public Services Card?”

Doherty: “Exactly as they always have done.”

Wilson: “What are people to do if they’re applying for their [driving] theory test? For their driver’s, their learner permit? And they’re asked for a Public Services Card? Are you saying it’s mandatory of compulsory or which? That they produce it?”

Doherty: “In most cases, in most cases, Mary, across all of Government departments, with maybe the exception of my own, there are different ways that you can apply for services and so there is a long-form way. And so, for argument’s sake, you can go and you can get your forms filled out in triplicate and bring your passport or driving licence…”

Wilson: “So you’re fudging it?”

Doherty: “No, I’m not. That’s a way that you can go and access services. The efficient way for people to access services is those who have a PSC card can do most of their conversing with the State online. And that still is true.

“So for people who don’t have a PSC card, nobody is absolutely going to make them get one but for those people who do have and want to deal with the State efficiently then, you know, 3.2million people tell us nine out of ten people, we conducted a survey…which tells us that it does actually make the transactional engagement much more efficient…”

Wilson: “What you’re saying is ‘we’ll make it so difficult for people to interact with the services that it’s going to be the only way forward’.”

Doherty: “No, no…no, no…”

Wilson: “That is what you’ll be doing.”

Doherty: “No, Mary, it’s not making it any more difficult. It’s just maintaining the way it always was….which was cumbersome.”

Wilson: “Meanwhile…meanwhile we have a report that you’re rejecting in full – all of the findings. And where are you going now? What is the next step?”

Doherty: “Well the next step is that we have to wait for the Data Protection Commission to enforce the findings, if they so wish. And because at the moment we don’t have anything that we can legally appeal. So I suppose we await for the Data Protection Commission to send us an enforcement notice.”

Wilson: “So you say ‘the ball is in your court, Helen Dixon’.”

Doherty: “Well, that’s just the reality, Mary so…”

Wilson: “The ball has been in your court since, was it August 2017 you got the draft report?”

Doherty: “No, I think it was that, that was the year the commission started their investigation and so…”

Wilson: “OK, you knew about the concerns since 2017. When did you first receive the draft findings of the Data Commissioner?”

Doherty: “So, in August of 2018, we received a draft report from the commission which we responded to comprehensively in November of 2018.”

Wilson: “The réponses – did they run to hundreds of pages?”

Doherty: “They did, yeah, they did.”

Wilson: “And at that point, did you inform your Cabinet colleagues of the content of that report?”

Doherty: “Well the first instruction from the Data Protection Commission was that the report was to be treated as private and confidential and wasn’t to be shared with anybody. We sought permission from the commission to share it with the Department of Public Expenditure, given that they are joint responsible for the roll-out of national services on an e-Government basis. That permission was granted and both myself, my department, and DPER compiled a very comprehensive response to the initial findings in the draft report and that did run to some 170 pages. And that was returned to the commission in November 2018.”

Wilson: “And where do you see this going though? You say you’re waiting for an enforcement order to come from the data commissioner. Do you then take it to the courts? What is the protocol? I don’t know what the process is here? What is the Attorney General advising you to do?”

Doherty: “So again it very much depends what’s in the enforcement notice and, given that we haven’t seen it yet, it’s difficult for me to be precise.”

Wilson: “But what are the options?”

Doherty: “In normal circumstances, if an enforcement notice was issued to a department that it didn’t agree with, it would take an appeal of that enforcement notice. In this particular case, it would probably start in the Circuit Court. The other possibility is to conduct a judicial review but, again, without seeing what’s in the enforcement notice, it’s a bit difficult to be precise.”

Wilson: “Would you want to expedite this quickly?”

Doherty: “Well look I’m very comfortable with the fact that the legal advice that I have given, gives me confidence that we are doing exactly what was established and set out as far back as 1998 and, as I said, it’s been reinforced in various different pieces of legislation by various different ministers for social protection and employment affairs.”

Wilson: “But it’s starting down the road now of legal challenges. You could be accused of kicking the can down the road and avoiding doing what you ultimately  you may have to do anyway.”

Doherty: “But how could I kick the can down the road of doing something I have no intentions of doing because I have no, because I don’t agree with it? And so where I have legal basis is, is that the legislation that was established in 1998, reformed in 2005, 2007, 2009 and 2011 and 2013 gives me robust legal basis to conduct the Government policy across any Government platform as was envisaged…”

Talk over each other

Wilson: “And you know as well that lawyers will differ and judge will ultimately in a court will have to decide and then ultimately you may have to accept an outcome contrary to what you believe yourself.”

“In any event, there is also another process now where the [Irish] Examiner is reporting today about the second generation of the Public Service Card. A further two million or so cards that are going to be processed. Is that continuing? Is that tender, is that contract signed? Is that tender done and those cards being prepared?”

Doherty: “There’s no iteration of a new version of card, I’m not sure where the Examiner is getting its information from. The Public Services Card is being renewed, the contract has just been renewed with a new agency to do what will be our second generation but it’s just the lifespan of a Public Service Card is seven years. We’ve come to the end of that and are starting a new card. I’m not sure, I haven’t seen the article in the Examiner so…”

Wilson: “I presume the new card will have more and varied capacity or ability…”

Doherty: “Well, there’s no plan in the legislation to have…”

Wilson: “You can tap it?”

Doherty: “No.”

Wilson: “That’s not going to be on the card?”

Doherty: “Well, it’s not in the current legislation so I can’t see why we would…”

Wilson: “And how much  are you spending now on the, the additional 2.6million cards?”

Doherty: “Again, it’s not additional spending. The project that was envisaged in as to roll out in 2005, sought to actually ensure that everybody was identified and registered under the Safe 2 process. The PCS process is a by-product of that, it’s only a token that’s given at the end of the identification and authentication process.”

Wilson: “And what’s it costing?”

Doherty: “Well, at the moment, I think we’ve just spent over €60million. I think that’s a very good and strong investment in the delivery of public services.”

Wilson: “We don’t know that yet. You actually don’t know that yet. You’re going to challenge the Data Commissioner’s findings so, ultimately, this will go through the courts. And, ultimately, that €60million, plus additional funding that you may continue to spend, could be money down the drain.”

Doherty: “I tell you what I do know, Mary, is that 3.2million people have taken the time to come in and get themselves identified and registered until the Safe Two process because they want and value to be able to do they business online, in an efficient and quick manner…”

Wilson: “Perhaps because they were told that it was compulsory and mandatory to get it by you.”

Doherty: “Well, they’re not,  they were invited in. And actually I think if you look at the finding of the one, of the first finding in the Data Protection [Commission’s] eight findings is that she has entirely deemed it legal for the Department of Social Welfare and Employment Affairs…”

Wilson: “She has…the only department that it is legal to use..”

Doherty: “…And..that’s the department that we were talking…”

Wilson: “And do you accept, you accept that finding?”

Doherty: “To go back to what I was saying to you a second ago is that we have 3.2million people who have registered extremely high satisfaction rates with the usage of the card. They value it and…it’s my job to make sure that I continue to provide those services in an efficient manner for the people that we serve.”

Wilson: “Minister Regina Doherty, thank you for joining us.”

Listen back in full here

Meanwhile..

If you are using a Dash Cam for security or accident liability purposes, you should be aware that the publication of footage, for example on social media platforms, represents a further processing and risks infringing the privacy rights of recorded individuals and data protection legislation.

Publication of personal data can be justified in certain circumstances for journalistic purposes but this must be carefully balanced with the privacy rights of the individuals concerned.

Hmm.

Guidance for Drivers on use of “Dash Cams” (Data protection Commission)

From top: Paschal Donohoe, then Minister for Public Expenditure and Reform, launches the Public Services Card (PSC) in 2016; Oireachtas justice committee, Anna Morgan and Jennifer O’Sullivan, of the Data Protection Commission; and Independents 4 Change TD Clare Daly

This morning.

Members of the Data Protection Commission are appearing before the Oireachtas justice committee which includes Independents 4 Change TDs Mick Wallace and Clare Daly.

In January the Department of Employment and Social Protection refused to release information with regard to the an investigation by the DPC into the legality of the public services card.

The request for the information was made by the the Irish Council for Civil Liberties.

Instead, the DPC confirmed to The Irish Times that the DPC doesn’t intend to publish its report in full.

This morning, the DPC told the committee they will publish final report with the department’s permission.

But the department has previously said it will not publish the report without the DPC’s permission.

In addition, asked if the DPC agrees with Minister for Employment Affairs and Social Protection Regina saying the Public Services Card doesn’t involve biometric data processing, the DPC representatives said they couldn’t comment.

Lawyer Elizabeth Farries, of the Irish Council for Civil Liberties, has been following this morning’s meeting and has said she’s disappointed with the answers given by the DPC members in response to certain questions.

Elizabeth tweetz:

Previously: ‘A Matter Of Urgent Importance’