What just happened?
The Department of Employment Affairs and Social Protection has published the full report of the Data Protection Commissioner’s investigation into the Public Services Card (PSC). Much of what the report found has been known for a month, but the department has held off on publication until now. It has also published its response to the report, and correspondence between the commissioner and the department.
Is there anything new in there?
We knew the broad strokes of the report’s findings, that aspects of the PSC project are unlawful, and that the commission wants the department to delete documentation containing data on millions of people. All that is contained in the full report, as would be expected.
However, new light has been shed on the soured relationship between the department and the commission. It’s clear from the report that the department rejects totally many of the key findings of the investigation, and has taken serious umbrage at how the commission went about its investigation. As reported by The Irish Times on Tuesday morning, the department believes its right to fair procedure was breached, and has a list of procedural and legalistic grievances as long as your arm.
Why has it taken so long?
The commission wanted the report published as soon as possible, but that stipulation was just one of many made by the watchdog which the department completely ignored. Instead, officials have hunkered down with the Department of Public Expenditure and Reform, the Attorney General and outside counsel, and is extremely bullish following legal advice which it says vindicates its stance.
With the two parties this far apart, the possibility of a politically convenient fudge is remote. Initially it was thought that the problem could be solved through the introduction of amending legislation, but now a court battle seems likely to follow.
So what happens next?
In the immediate term, the commission is likely to issue an enforcement notice against the department for its failure to comply with the conditions attached to the report, which included producing a plan on how it was going to get its house in order. Given the fact that the department believes its house is already in order, this will be appealed to the Circuit Court. This may set off a series of appeals to higher courts, with neither party likely to blink at this stage.
Daragh O'Brien, managing director of privacy consultant Castlebridge, predicts that this will end up in Europe. "The endgame for any appeal by the department will be the CJEU [Court of Justice of the European Union], as DPC will likely appeal any negative findings and the department will inevitably appeal any finding that favours the DPC. At the CJEU, no matter who wins Ireland loses, as the credibility of our regulatory regime in the global economy will be on the line," he says.
Meanwhile, the commission will continue with the second module of its investigation, into the capturing of biometric data. Publication of this is not imminent, but it is in train – and could mean another theatre for the war between the pair to play out in. It is also open to the commission to open yet another investigation under the strict GDPR legislation introduced last year.
More immediately, the commission is in front of the Public Accounts Committee next Thursday, nominally to discuss its accounts – but the real emphasis will be on the PSC.
What does this mean for my PSC?
As has always been the case, the difference on the ground for ordinary citizens is effectively nil. The cards continue to be acceptable for many services, and the department will continue to issue them. Given the strength of feeling in the department that it is correct, it is likely the PSC will continue to operate as before while the two sides battle over its future.
With both sides digging in, whichever public body ultimately loses out will suffer a heavy blow, with far reaching implications for the State.
