Tag Archives: Helen Dixon

From top: Public Services Card; Children’s Minister Katherine Zappone (left); Data Protection Commissioner Helen Dixon

This morning.

In The Irish Examiner.

Cianan Brennan reports that the Department of Children and Youth Affairs still hasn’t replied to a near two-week-old request from the Data Protection Commissioner for information concerning the controversial Public Services Card and the new National Childcare Scheme.

The scheme was scheduled to begin at the end of this month but now won’t begin until November.

Mr Brennan reports:

“The commissioner’s query concerns the requirement for all applicants to the new scheme to hold a public services card, which is perceived as being at odds with the commissioner ’s recent finding that mandating citizens to hold a PSC in order to access State services other than welfare is illegal.

“…The department has become something of an outlier since the publication of the commissioner’s report into the PSC on September 17, as the majority of other departments have since dropped their mandatory PSC requirement, despite Social Protection Minister Regina Doherty’s stated intention to legally challenge the commissioner’s rulings.”

Anyone?

Department yet to reply to Public Services Card info request (Cianan Brennan, The Irish Examiner)

Previously: House Of Card

‘Iarnród Éireann Used The Public Services Card To Collect The Information’

‘It Would Be In The Circuit Court So It Probably Wouldn’t Be Very Expensive’

Data Protection Commissioner Helen Dixon; Labour TD Alan Kelly

This morning.

The Data Protection Commissioner Helen Dixon is fielding many questions about the Public Services Card at a meeting of the Public Accounts Committee.

But separate to the Public Services Card, and in response to a question from Labour TD Alan Kelly, Ms Dixon told the committee that, in terms of the supervision and enforcement of data protection law, Irish taxpayers will incur costs for having multi-nationals headquartered in Ireland.

Ms Dixon said:

“Once the Irish DPC [Data Protection Commissioner] starts administering fines and sanctions on companies, there has been a debate about whether all of that goes to the Irish Exchequer and whether that isn’t shared across the EU member states.

“At the moment, it’s our understanding that it goes to the Irish Exchequer.

“So, already, there’s an opposite debate to the question you’re opening up which is that: well is that fair? If Ireland supervises most of these big tech companies and there are infringements and fines, does Ireland get to keep the fines? So that’s an open question that’s ben raised a number of times.

“In relation to the costs, I think it’s well possible that the Irish taxpayer will end up, by virtue of these companies being headquartered here, incurring costs.

“The Irish taxpayer has incurred costs already in relation to the case that you referenced that’s before the Court of Justice at the European Union on transfers of data because it arose from a complaint by Max Schrems against Facebook Ireland.

“Facebook Ireland being located here means that we are responsible.

“However, under this Co-operation and Consistency Mechanism that operates around the one-stop shop in the EU now, if there’s a dispute in relation to the findings that I make – so I’ve to circulate a draft decision in relation to any of these cases that concern multi-nationals to my fellow EU Data Protection authorities.

“And if ultimately they have a different view, that I can’t reconcile into my findings, I institute a dispute resolution mechanism before the European Data Protection Board and it may take over the decision making. And if a company affected by that decision disagrees with it, it takes an annulment action to the Court of Justice of the European Union.

“So, there will be a certain number of cases that may end up being taken out of Ireland’s hands because of disagreement between data protection authorities and the European Data Protection Board will then have to bear the cost for defending those cases before the CJU.

“But, undoubtedly, the effect of having the multi-nationals headquartered in Ireland is going to give rise to costs for Ireland in terms of the supervision and enforcement of data protection law.”

Watch the proceedings live here

RTÉ’s Mary Wilson; Minister for Employment Affairs and Social Protection Regina Doherty and Minister for Finance Paschal Donohoe; Public Services Card

Last night.

On RTÉ’s Drive Time.

Minister for Employment Affairs and Social Protection Regina Doherty was interviewed by Mary Wilson following the publication, by her department, of the Data Protection Commission’s report into the Public Services Card.

Before their interview began, listeners heard a clip of an interview the Data Protection Commissioner Helen Dixon had with RTÉ’s Miriam O’Callaghan last month – during which Ms Dixon spoke about what the DPC had ordered Ms Doherty’s department to do.

These orders included that Ms Doherty’s department had to stop issuing new cards, with immediate effect, to people seeking a service that’s outside of her department – and Ms Dixon asked that the department write to her within 21 days to outline how the department carried out that order.

The DPC also ordered that the department delete the supporting documentation – such as utility bills, etc – that the department had retained on the 3.2million card holders. Ms Doherty was to write to Ms Dixon about that within six weeks.

But last night, Ms Doherty was categorical that her department will not be complying with these orders.

From last night’s interview:

Mary Wilson: “You heard what the Data Protection Commissioner said there. She said that on the 16th of August. Have you complied with all of those directions?”

Regina Doherty: “Well, I think, as is on the record, we took a number of weeks to consider the votes, the letter that the commission sent us and the report with all of its eight findings. And the simple and short answer to your question is ‘no’. Because we don’t agree with any of the eight findings and we have written to the commission to outline that.”

Wilson: “So, where to now?”

Doherty: “Well I suppose the position is that we’ve made, we’ve reacted to the instructions that the Data Protection Commission gave us in the letter of the 15th. We’ve requested a meeting, on a number of occasions, to see if we could establish. There are some inconsistencies with regard to the findings and the instructions in the letter and some of…”

Wilson: “Like what?”

Doherty: “It’s kind of technical, it’s…”

Wilson: “Well, we need to get technical, minister then because this is a damning report on your department and the operation of the Public Services Card and your response is that you’ve got problems with some complicated issues or fair procedures.”

Doherty: “No, well, actually, that’s not what I said. And our response I think is very clear and unambiguous, in so far as that we disagree and the legal advice that we’ve obtained, from the Attorney General, is that we have an incredibly strong legal basis to do exactly what was set out in the 1998 legislation, established in the 2005 legislation and amended thereafter in 2007, 2009, 2011 and 2013.

“And so we’re not trying to be ambiguous in any way, shape or form. Which is why we’ve been as transparent as we have been today – not only to publish the findings and the report from the Data Protection Commission but to publish the correspondence that’s gone on between ourselves and the commission since then.

“I’ll give you a small example of the difference between the findings in the report and the instructions in the letter.

“One of the findings in the report is that we, should not, under Data Protection law, retain data indefinitely. I’m not sure what the legal definition of indefinitely means but the instructions in the Data Protection Commission’s letter is that we have to immediately delete all of the data that we hold on people, even for people who’ve only got a PSC card last week.”

Wilson: “Supporting documentation, minister.”

Doherty: “That’s correct, yeah.”

Wilson: “Not the name, and so on, it’s the supporting documentation…”

Doherty: “So to be clear, Mary, that data set…”

Wilson: “…the data sent to get the card.”

Doherty: “The data set is entirely different to the supporting documentation and the discrepancy or the inconsistency is with regard to the supporting documentation. And that’s only one example. But unfortunately, we haven’t been able to meet with the Data Protection Commission staff and that’s why we are where we are today which is why we’re publishing the report…”

Wilson: “So, just to be clear before you move on. Just to be clear before you move on. You will not be getting rid of or eliminating or destroying the supporting documentation that you retain on 3.2million people who’ve received the card?”

Doherty: “No, Mary, because our advice is that it would be illegal and so if I acted as the directions in the Data Protection Commission’s letter has suggested, I would actually be contravening the legislation that underpins the practice and the policy as far as 1998 and that would be illegal.

“And that’s the advice that I have. And with respect to my role and my job, which is defending the delivery of services, in an efficient manner, to the public which we serve, we regard the legal basis underpinning this service to be incredibly strong.”

Wilson: “Will you stop any demand for the Public Service Card for the delivery of services other than welfare services?”

Doherty: “So, to say again, Mary. The eight findings, in its entirety, are not accepted by ourselves in Government and so we won’t be complying with any of the instructions with regard to the findings or the instructions in the letter.”

Wilson: “Spell that out for the public. When I go to apply for a passport now, are you going to ask for a Public Services Card?”

Doherty: “So, to spell it out for the public, in so far as 3.2million people in Ireland already have data, or PCS [sic] cards. Anybody that doesn’t have one is usually invited to come in and be registered under the SAFE 2 process and that allows them access. All of the public services across Government departments, on a once and done basis, and so what you would be suggesting that we do, is to go back and asking people to fill out forms in triplicate, across a number of departments…”

Wilson: “No, no, no. I asked a simple question: what are people to do now if they’re applying for a passport and they’re asked for a Public Services Card?”

Doherty: “Exactly as they always have done.”

Wilson: “What are people to do if they’re applying for their [driving] theory test? For their driver’s, their learner permit? And they’re asked for a Public Services Card? Are you saying it’s mandatory of compulsory or which? That they produce it?”

Doherty: “In most cases, in most cases, Mary, across all of Government departments, with maybe the exception of my own, there are different ways that you can apply for services and so there is a long-form way. And so, for argument’s sake, you can go and you can get your forms filled out in triplicate and bring your passport or driving licence…”

Wilson: “So you’re fudging it?”

Doherty: “No, I’m not. That’s a way that you can go and access services. The efficient way for people to access services is those who have a PSC card can do most of their conversing with the State online. And that still is true.

“So for people who don’t have a PSC card, nobody is absolutely going to make them get one but for those people who do have and want to deal with the State efficiently then, you know, 3.2million people tell us nine out of ten people, we conducted a survey…which tells us that it does actually make the transactional engagement much more efficient…”

Wilson: “What you’re saying is ‘we’ll make it so difficult for people to interact with the services that it’s going to be the only way forward’.”

Doherty: “No, no…no, no…”

Wilson: “That is what you’ll be doing.”

Doherty: “No, Mary, it’s not making it any more difficult. It’s just maintaining the way it always was….which was cumbersome.”

Wilson: “Meanwhile…meanwhile we have a report that you’re rejecting in full – all of the findings. And where are you going now? What is the next step?”

Doherty: “Well the next step is that we have to wait for the Data Protection Commission to enforce the findings, if they so wish. And because at the moment we don’t have anything that we can legally appeal. So I suppose we await for the Data Protection Commission to send us an enforcement notice.”

Wilson: “So you say ‘the ball is in your court, Helen Dixon’.”

Doherty: “Well, that’s just the reality, Mary so…”

Wilson: “The ball has been in your court since, was it August 2017 you got the draft report?”

Doherty: “No, I think it was that, that was the year the commission started their investigation and so…”

Wilson: “OK, you knew about the concerns since 2017. When did you first receive the draft findings of the Data Commissioner?”

Doherty: “So, in August of 2018, we received a draft report from the commission which we responded to comprehensively in November of 2018.”

Wilson: “The réponses – did they run to hundreds of pages?”

Doherty: “They did, yeah, they did.”

Wilson: “And at that point, did you inform your Cabinet colleagues of the content of that report?”

Doherty: “Well the first instruction from the Data Protection Commission was that the report was to be treated as private and confidential and wasn’t to be shared with anybody. We sought permission from the commission to share it with the Department of Public Expenditure, given that they are joint responsible for the roll-out of national services on an e-Government basis. That permission was granted and both myself, my department, and DPER compiled a very comprehensive response to the initial findings in the draft report and that did run to some 170 pages. And that was returned to the commission in November 2018.”

Wilson: “And where do you see this going though? You say you’re waiting for an enforcement order to come from the data commissioner. Do you then take it to the courts? What is the protocol? I don’t know what the process is here? What is the Attorney General advising you to do?”

Doherty: “So again it very much depends what’s in the enforcement notice and, given that we haven’t seen it yet, it’s difficult for me to be precise.”

Wilson: “But what are the options?”

Doherty: “In normal circumstances, if an enforcement notice was issued to a department that it didn’t agree with, it would take an appeal of that enforcement notice. In this particular case, it would probably start in the Circuit Court. The other possibility is to conduct a judicial review but, again, without seeing what’s in the enforcement notice, it’s a bit difficult to be precise.”

Wilson: “Would you want to expedite this quickly?”

Doherty: “Well look I’m very comfortable with the fact that the legal advice that I have given, gives me confidence that we are doing exactly what was established and set out as far back as 1998 and, as I said, it’s been reinforced in various different pieces of legislation by various different ministers for social protection and employment affairs.”

Wilson: “But it’s starting down the road now of legal challenges. You could be accused of kicking the can down the road and avoiding doing what you ultimately  you may have to do anyway.”

Doherty: “But how could I kick the can down the road of doing something I have no intentions of doing because I have no, because I don’t agree with it? And so where I have legal basis is, is that the legislation that was established in 1998, reformed in 2005, 2007, 2009 and 2011 and 2013 gives me robust legal basis to conduct the Government policy across any Government platform as was envisaged…”

Talk over each other

Wilson: “And you know as well that lawyers will differ and judge will ultimately in a court will have to decide and then ultimately you may have to accept an outcome contrary to what you believe yourself.”

“In any event, there is also another process now where the [Irish] Examiner is reporting today about the second generation of the Public Service Card. A further two million or so cards that are going to be processed. Is that continuing? Is that tender, is that contract signed? Is that tender done and those cards being prepared?”

Doherty: “There’s no iteration of a new version of card, I’m not sure where the Examiner is getting its information from. The Public Services Card is being renewed, the contract has just been renewed with a new agency to do what will be our second generation but it’s just the lifespan of a Public Service Card is seven years. We’ve come to the end of that and are starting a new card. I’m not sure, I haven’t seen the article in the Examiner so…”

Wilson: “I presume the new card will have more and varied capacity or ability…”

Doherty: “Well, there’s no plan in the legislation to have…”

Wilson: “You can tap it?”

Doherty: “No.”

Wilson: “That’s not going to be on the card?”

Doherty: “Well, it’s not in the current legislation so I can’t see why we would…”

Wilson: “And how much  are you spending now on the, the additional 2.6million cards?”

Doherty: “Again, it’s not additional spending. The project that was envisaged in as to roll out in 2005, sought to actually ensure that everybody was identified and registered under the Safe 2 process. The PCS process is a by-product of that, it’s only a token that’s given at the end of the identification and authentication process.”

Wilson: “And what’s it costing?”

Doherty: “Well, at the moment, I think we’ve just spent over €60million. I think that’s a very good and strong investment in the delivery of public services.”

Wilson: “We don’t know that yet. You actually don’t know that yet. You’re going to challenge the Data Commissioner’s findings so, ultimately, this will go through the courts. And, ultimately, that €60million, plus additional funding that you may continue to spend, could be money down the drain.”

Doherty: “I tell you what I do know, Mary, is that 3.2million people have taken the time to come in and get themselves identified and registered until the Safe Two process because they want and value to be able to do they business online, in an efficient and quick manner…”

Wilson: “Perhaps because they were told that it was compulsory and mandatory to get it by you.”

Doherty: “Well, they’re not,  they were invited in. And actually I think if you look at the finding of the one, of the first finding in the Data Protection [Commission’s] eight findings is that she has entirely deemed it legal for the Department of Social Welfare and Employment Affairs…”

Wilson: “She has…the only department that it is legal to use..”

Doherty: “…And..that’s the department that we were talking…”

Wilson: “And do you accept, you accept that finding?”

Doherty: “To go back to what I was saying to you a second ago is that we have 3.2million people who have registered extremely high satisfaction rates with the usage of the card. They value it and…it’s my job to make sure that I continue to provide those services in an efficient manner for the people that we serve.”

Wilson: “Minister Regina Doherty, thank you for joining us.”

Listen back in full here

Meanwhile..

Above:Data Protection Commissioner Helen Dixon on RTÉ Radio One this morning; Minister for Employment Affairs and Social Protection Regina Doherty

This morning.

The Data Protection Commissioner Helen Dixon spoke to Miriam O’Callaghan on RTÉ’s Today with Miriam O’Callaghan.

It followed Ms Dixon’s finding that there is no legal basis for anyone to have to present a Public Services Card in respect of any transaction between a person and a public body outside the Department of Employment and Social Protection – such as obtaining a drivers’ licence, passport, education grants, etc.

And her finding that the supporting information that the 3.2 million card holders had to hand over in order to get their card – such as utility bills, proof of ID, etc – must now be deleted.

Ms O’Callaghan told listeners that the show sought an interview with the Minister for Employment Affairs and Social Protection Regina Doherty – who famously, in 2017, said the cards were  mandatory but not compulsory” – but she was not available.

Her spokesperson said she has received Ms Dixon’s report and that she will respond in “due course”.

Ms Dixon clarified a number of her findings outlined in her press release issued this morning.

In respect of her call for the destruction of data held on the 3.2 million card holders, she said:

They have to delete the supporting documentation that they collected. They do not have to delete the PSI dataset elements and what that Public Sector Identity set elements are are the name, address – the information that they extract and validated from the supporting documentation will not be deleted. Because existing cards are not invalid. It’s the supporting documentation that they must delete.”

In respect of how the card has been used – by departments outside the Department of Employment and Social Protection – Ms Dixon said that she has found other departments have recently been rowing back on demanding that a Public Services Card be presented.

She said:

“As far as we can see the only mandatory requirements at the moment, outside of the department itself, are from the immigration service for citizenship applications and the passport office for new adult passport applicants.

“So in fact, already, some of the bodies have rolled back and usefully so in light of our findings.”

She added:

“As I say, what the Government does from here, and what it intends and wants the system to be, is a matter for the Government.”

Asked by a listener if they should cut up and destroy their card, Ms Dixon said:

“No I hope it’s clear from what I’ve said that cards that have been issued are valid, can continue to be used to avail of free travel and if the individual asking is a benefit recipient from the department then they must still produce it as required.” 

Meanwhile

Independent TD Catherine Connolly

Independent TD for Galway West Catherine Connolly also joined Miriam O’Callaghan this morning.

Ms Connolly said:

“As I understand it, the Department has had a copy of the draft report since August of last year and I’ve just heard Helen Dixon say that in August last year, notwithstanding that the Government had a copy of the draft report with all of these concerns, they simultaneously extended the requirement to have this card for other services.

“That in itself tells me something.”

Ms Connolly also said that since she started being a TD in 2016, she and other TDs have consistently raised the issue in the Dáil and the Public Accounts Committee.

She also paid tribute to a “female Irish Times” journalist who has been writing about the matter but failed to mention her name. Presumably Ms Connolly was referring to Elaine Edwards.

Ms Connolly said:

The response from the minister and the Government was patronising. They said they knew best. We were raising matters that weren’t relevant, that we were making a big deal out of nothing.”

She added:

“What has happened here is it was the introduction of an identity card by stealth. There may well be arguments for an identity card but they were never discussed in the Dáil. In fact, it was frankly denied by the Government.”

Ms Connolly also asked why no comprehensive business case was given the Public Accounts Committee for the roll-out of the cards – which is estimated to have cost €62million to date.

Listen back in full here

Earlier: Your Card Has Been Declined

Meanwhile…

From top: Yesterday’s Irish Independent; and from the Irish Independent-sponsored data security conference

Further to the alleged data breach at Independent News and Media…

And reports that the Data Protection Commissioner Helen Dixon is to investigate into the alleged breach…

And the Irish Independent-sponsored data security conference in Dublin on Monday…

Gemma O’Doherty tweetz:

I have asked @DPCIreland Helen Dixon whether she still intends to be the keynote speaker at INM’s conference on data protection next week given she is investigating an alleged data breach by the company #INM19 #INM #dataprotection

GDPR?

Dublin Data Sec 2018 

Previously: Look Hack In Anger

‘Arguably One Of The Largest Data Breaches In The History Of The State’

UDPATE: