Protect personal ID numbers, urges boss

PRIVATE healthcare agencies should not be given access to personal identity numbers without legislation to protect personal details, the Data Protection Commissioner (DPC) has warned.

Due to launch his annual report for 2002 today, the commissioner, Joe Meade, said he was concerned allowing private health care access to Personal Public Service Numbers (PPSN) could lead to the release of information to the wrong individuals.

A spokesman for the DPC said that PPSN numbers were introduced as a number unique to the individual, used in transactions between the citizen and the State and to which only they should be privy.

However, an increasing number of private agencies are seeking access to the number, particularly in the area of health care.

“What we are concerned about is that if its use is extended, it could become a method of getting low-level information about other people. It could be used over the phone to impersonate some-one else and obtain information about them from State agencies,” said the spokesman.

The PPSN was introduced recently under Social Welfare legislation and replaces the RSI number.

It is quoted in all social welfare transactions and is used to obtain a free travel pass, medical card, childhood immunisation and housing grants and mortgage and interest relief.

Aer Rianta has already been criticised by the DPC for requesting PPSN’s from taxi drivers at Dublin Airport, in breach of social welfare legislation. The commission will also deal with a series of complaints from individuals about invasion of privacy in his annual report.

They include a complaint from an individual that gardaí logged personal details on their Pulse computer system that were not relevant to any police operation. The DPC spokesman said the main problem arose when the individual complained to the DPC that the gardaí had erased the detail in question from their computer when he asked for a printout. The gardaí were warned by the DPC not to do this again and to accede to requests for information.

Another complaint involved a bank which recorded a customer’s phone call without informing him in advance. The bank was reprimanded by the DPC and promised to restrict the number of recorded transactions in the future as well as informing customers of the practice.

The organisers of Dublin Women’s Mini Marathon were warned against supplying photographic agencies with names of participants without informing them in advance and motor insurance companies were told not to ask potential customers their marital status because it had no bearing on premia.

The Department of Defence was taken to task for supplying the Department of Social and Family Affairs with a full list of army personnel to receive compensation under army deafness claims.

The department should only have supplied the names of those in receipt of social welfare benefits, whose compensation awards would be taken into account by social welfare in determining entitlements.

The DPC described it as “excessive sharing of information”, which could lead to a big brother situation of departments sharing information under their own rules.

An individual politician and a political party were reprimanded for direct marketing through automated dialling to voters’ homes and the Department of Health was told to issue new guidelines to health boards after a director of public health tried to get information on an infectious disease (TB) from a pharmacist, rather than the legally acceptable method of obtaining details from a GP.