The controversy over the Public Services Card appears to be unspooling on a public relations basis, rather than a legal one, writes Cianan Brennan.
The Data Protection Commissioner’s highly critical report into the PSC project was finally published on Tuesday, which is all to the good. That it appears to have been released under duress, given the Department of Employment Affairs and Social Protection had claimed as recently as last Friday that to publish the report would emphatically not be in the public interest, is interesting but now also moot.
What matters is that it is now in the public domain, as is the fact that relations between the State’s largest department and its data regulator may have now been soured beyond repair.
Acid observations are ten a penny in the report, which found, as was well flagged in advance, that Social Protection must delete the 3.2 million historical records it holds on its citizens and that data processing using the PSC for services other than welfare is unlawful.
For example, the Commissioner Helen Dixon notes that the Department’s initial response to its adverse findings, in August of 2018, amounted to 470 pages of non-searchable material.
The inference is clear - what right-minded cooperative body would deliver an enormous wealth of material in the current day and not paginate it?
The Commissioner also sets out 23 instances of adversarial reporting in the public domain in contradiction of the Department’s statement that there has been “no public unrest or dissatisfaction” with the PSC.
Leaving that aside, since the context of the report was largely known in advance, it is the Department’s response which is more intriguing.
That response, released in tandem with the report, is 120 pages long (for sure, this is one State body that does not believe in succinctness).
Over those 120 pages (72 of which detail correspondence between Social Protection and the DPC, together with a survey commissioned on the purported ease of use of the card dating from February 2019) the Department’s position is repeatedly set out with regard to the draft report. The one from a year ago. Not the final report, the draft.
No legal rebuttal is set out regarding any of the DPC’s findings as a matter of law.
The only consideration given to the final version of the report is in the aforementioned correspondence between the Department and the DPC.
In those missives, the secretary general of Social Protection John McKeon asserts that Ms Dixon’s initial publication of her findings in August “does not appear to have any legal effect”. However, this seems to only mean that the Department does not consider the DPC going public as constituting an enforcement notice.
Whether or not this is the case is debatable. The investigation was conducted under the auspices of the 1988 and 2003 Data Protection Acts (as it had begun before GDPR came into force in May 2018).
Under the 1988 Act, such a notice will comprise any “notice in writing” served on a person which requires them “to take such steps as are specified in the notice within such time as may be so specified to comply with the provision concerned”. It would be hard to argue that the DPC’s communication of August 16 would not comprise such a notice, and if it does, the 21 days which the Department had to appeal has long since expired.
Interestingly, one key piece of correspondence is omitted - the letter delivered to the DPC by hand from the secretary general last week which stated that the DPC’s ruling that the Department accede to its findings within 21 days has “no particular legal force”.
Why that particular letter was left out is a mystery. It could be interpreted as Social Protection, possibly with some justification, asserting that since the investigation took place under repealed legislation that the DPC’s findings are of no consequence.
However, that’s it. Aside from saying that the Department doesn’t agree with the DPC’s findings, no legal rebuttal is given.
In fact, the response stresses from the beginning that “it does not include the detailed legal advice of the Attorney General’s Office” which Minister Regina Doherty has been citing as an “incredibly robust” means with which she can defy the Commissioner. Surely, that is the one, legally indispensable, thing which readers of the Department’s riposte would wish to see.
So we come back to the PR battle. The first shot in anger from that point of view was arguably delivered by the Commissioner herself, who, possibly chagrined at the seemingly never-ending nature of the two-year investigation, decided to go public with her findings, thus dragging the whole shebang kicking and screaming into the light of day.
In more recent times, the Minister and the Taoiseach have elected to pin the blame for the debacle on a Government that has been out of office for 21 years.
Indeed, on the first page proper of the response, former Fianna Fail minister Dermot Ahern is quoted “speaking specifically about the PSC” as saying:
The only problem with that quotation is that Mr Ahern was referencing the citizen’s PPS (social security) number, not any variety of Public Services Card. Such an egregious mistake, easily solved by a dedicated 30 seconds of Googling, is symptomatic of the ridiculouness of this whole sorry mess.
Finally, and most significantly, the Department includes the results of the aforementioned survey, which it commissioned itself, as evidence of the public’s overwhelming happiness with the PSC process.
As an aside, one of those findings states that the main reason for respondents’ getting a PSC (37% of them in fact) is as a means of gaining “access to other Government services”. You know, like passport applications, for which the requirement to hold a PSC was summarily dismissed by the Department of Foreign Affairs yesterday. The impression of a house of cards collapsing springs to mind.
Nevertheless, what does public sentiment have to do with any of this?
The PSC debate is a matter of law, not sentiment. It may be that the Department will get its act together, appeal the decision in the Circuit Court (or higher), and win.
What you can be assured of in that case is that the DPC will appeal that finding, and the whole thing will end up at the Court of Justice of the EU. That would take three years, at a cost of probably the guts of a million euro, for which the taxpayer will foot the bill as two agencies, supposedly working in his or her name, go to war with each other.
Therein lies the rub, because whoever wins, one thing is certain - the only losers in this PSC fiasco are you and I.