Questioning the Data Protection Commissioner’s judgment gives lie to the contempt with which the State holds privacy rights and the office itself, writes Cianan Brennan
The Government’s decision to challenge the highly critical findings of the Data Protection Commissioner on the Public Services Card may prove to be a supreme act of folly.
This issue needs to be looked at both politically and legally.
In political terms, the State has a flaming football in its possession that needs to be taken out of play — and quickly.
For whatever reason, simply acknowledging that they’ve got it wrong doesn’t seem to be an option, and so they’ve kicked for touch. Threaten legal action, lean on the DPC to alter its findings in some manner, and hey presto — the issue doesn’t need to be dealt with for months, perhaps years, and things can carry on as they were.
Except that isn’t really an option here. Forget the fact that if the State acceded to the DPC’s orders and carried out its rulings, then something might actually be salvaged from an (at least) €60m project which has never once had a business case made for it. Concentrating more on the fact that carrying on as if nothing had happened is simply not possible.
The DPC is an independent statutory regulator with extensive powers in the post-GDPR world. Three weeks ago, the commissioner ordered that all processing via the card by bodies other than the Department of Social Protection must cease by today’s date. In ignoring that order, the State is now in breach of its own laws, and liable for legal action.
Leave that aside even, and consider the “incredibly strong legal advice”, in her words, that Social Protection Minister Regina Doherty has received indicating that she’s in the right. How does that advice trump the State’s own de facto authority on data protection?
The minister has said she won’t publish that legal advice. Why not?
More bluntly, will the department really appeal? If it wishes to do so, then significant time pressures apply. The minister has said no enforcement notice has yet been served and therefore she cannot yet appeal. That is debatable.
The DPC Helen Dixon’s decision to publicise her findings on August 16 was an unusual one, and probably designed to bring the whole protracted issue into the public arena from the doldrums in which it lay. But nevertheless, her statement on that date was quite clear — the Government had 21 days with which to cease processing data for services other than welfare using the card. That deadline is today.
Let’s look at the appeal route.
That can take the form of either a circuit court appeal, or an application for judicial review, the latter of which is by far the more serious. More on that anon.
However, the Department of Social Protection declined to answer a straight question yesterday — would it be taking the Data Protection Commissioner to court as a plaintiff, that is, as the supposed injured party, regarding her ruling? That would suggest that the State is fully aware of the implications of going the legal route, and of the improbability that it would win.
Much of the debate yesterday came down to semantics, as have most of the responses of Social Protection and its colleague department, the Department of Public Expenditure and Reform, over the past three weeks.
In her interview on RTÉ’s Morning Ireland yesterday, Ms Doherty leaned heavily on the Social Welfare Consolidation Act 2005 for her argument that the Government had been operating in a legally proper manner.
That Act has since been amended retroactively dozens of times, one of the reasons the DPC’s investigation took so long in the first place — however it was the 2005 Act that the minister cited repeatedly, so that is what we have to consider.
The minister referred to subsection three of that Act, and 23 words that the department and the DPC disagreed over. Loose talk aside, there is only one section she could mean — subsection three of section 263 regarding a prospective Public Service Card. Those words are: “A person shall produce his or her Public Service Card at the request of a specified body for the purposes of a transaction.”
That’s it. You’ll note that nowhere in that sentence are the words “mandatory” or “compulsory” to be found. Put simply, there is no basis there for the blanket issuance of cards to citizens looking to access State services.
The DPC has already considered that sentence, and all the myriad legislation enacted since then, and has still returned her adverse findings. Why should the commissioner Helen Dixon change her mind? Because that is what the department is asking her to do.
Make no mistake, whether or not the commissioner chooses to entertain this approach is key. Given the DPC’s office has said it “notes” the minister’s statements, and has (again) called on her to publish the report immediately, the signs aren’t looking good for the Government.
Which brings us on to bigger matters. In the three weeks since the findings of the report were made public, the following has happened: Public Expenditure Minister Paschal Donohoe said the DPC’s findings would have to be acted upon; and the Taoiseach said that legislation would have to be drafted to make the PSC legal — an idea that was almost immediately shot out of the sky by Fianna Fáil.
That left two options open to the State: Comply with the DPC or go the legal route. And now Ms Doherty says that she “sincerely” believes the DPC has got it wrong. The Government has found secret Option C: Ask the commissioner to take it back.
There is no earthly reason why she should. The very fact the State would even consider questioning Ms Dixon’s judgment gives lie to the contempt with which it holds privacy rights and the office of the commissioner itself.
If the Government does go the legal route, there may be hell to pay. If it asks for judicial review, it will call into question every decision made by the commissioner. The DPC is no ordinary body — it monitors the data behaviour of the biggest tech companies in the world that are based here.
It currently has eight separate investigations open on Facebook alone. To impugn Ms Dixon’s authority on such spurious grounds could be calamitous.
As executive director of the Irish Council for Civil Liberties Liam Herrick said earlier this week: “The world is watching.” This matter concerns far more than a little plastic card. It comes down to proper governance and transparency.
And that’s not even taking into account the two other investigations pending on the Department of Social Protection by the commissioner, neither of which are expected to reflect kindly on the decision-making at the top of the Department.
Then there is the other option — the State could admit that it got it wrong.
Don’t hold your breath on that one.