The Minister for Social Protection, Regina Doherty, and the Minister for Finance, Paschal Donohoe, have informed the government that provision and use of the Public Services Card (PSC), not just by the Department of Employment Affairs and Social Protection (DEASP), but by other public bodies shall continue. The DEASP has written to the Data Protection Commission (DPC) advising it of this decision. In doing so, the Government accepts that it may be necessary for the matter to be referred to the courts for a definitive decision. The DEASP intend to publish the DPC’s investigation report following further engagement with the DPC.
Investigation by the Data Protection Commissioner
The DPC commenced an investigation into the PSC Scheme in 2017, and published its long awaited report (discussed here) on 16 August 2019. The report reached a number of conclusions about the use of personal data under the PSC Scheme, many of which were unfavourable to the DEASP. In particular, the DPC determined that the DEASP has no legal basis for processing personal data where a PSC is being issued solely for the purpose of a transaction between an individual and public bodies other than the DEASP.
In addition, the DPC were critical of the lack of transparency about the PSC Scheme. The DPC concluded that the DEASP did not comply with its transparency obligations under data protection legislation, insofar as the information provided to the public about how the DEASP and other public bodies used their personal data was inadequate.
Response from the Department for Employment Affairs and Social Protection
Having received advice from the Attorney’s General’s Office on the key criticisms of the report, the Ministers offered the following points in defence of the continued use of the PSC not just by the DEASP, but by other public bodies:
- They are satisfied that social welfare legislation provides a strong legal basis for the Department to issue PSCs for use by a number of bodies across the public sector.
- They are also satisfied that the retention of personal data is lawful, and the information provided to users in connection with the PSC satisfies the requirements of transparency under data protection legislation.
- Since its introduction, the PSC was always intended not just to reduce and identify welfare fraud, but to provide streamlined access to public services.
- Without the PSC process, citizens would be required to verify their identity on multiple occasions with multiple agencies rather than benefit from a single identity verification process. It is argued that this would make access to public services much more cumbersome for the general public.
- There was a high level of public satisfaction with the PSC, with a recent customer survey showing that 96% of PSC holders surveyed were either very satisfied or fairly satisfied with the process. It was also noted that in the weeks since the DPC announced its findings, there have been no reports of people returning their PSCs nor any reduction in the demand for PSC appointments.
The Ministers concluded that withdrawing or limiting the use of the PSC or the underlying scheme would be “inappropriate and potentially unlawful”, and they intend to continue to support the use of the PSC by both the DEASP and any other public bodies that rely on it.
The Ministers have offered to meet with the DPC in order to clarify a number of matters raised in the Report and to identify steps which could be taken in order to alleviate the DPC’s concerns.