Prison security systems violate data law, DPC rules

An officer in Castlerea Prison complained about the system to both management at the prison and his union, the Prison Officers Association, in early 2019. 

The Prison Service is illegally compelling prison officers to provide thumbprints in order to operate security systems, the Data Protection Commissioner (DPC) has found.

Officers in two prisons must provide thumbprints in order to open security gates within the prisons as part of a system that was originally designed to be rolled out for all 13 prisons in the State. 

An officer in Castlerea Prison complained about the system to both management at the prison and his union, the Prison Officers Association, in early 2019. 

He said that the provision of the biometric data was contrary to GDPR laws that were enacted the previous year.

He was instructed that the system had been agreed between management and unions, and he was compelled to comply with it or face disciplinary action. He then made a protected disclosure to the Data Protection Commission, which investigated the matter and issued a ruling earlier this month.

In her 17-page ruling, commissioner Helen Dixon found that “the Irish Prison Service has not established a legal basis for the processing of biometric data at issue in this case under Articles 6 and 9 GDPR and/or sections 46 and 49 of the 2018 Act”.

"As such, I find that the processing of the relevant biometric data of [complainant] in connection with the set-up and operation of the relevant key vending system in Castlerea Prison is unlawful,” the ruling stated. 

The prison officer who complained is now being facilitated in accessing the security system without providing his thumbprint, but no other officer is being similarly accommodated.

In the investigation, the IPS had claimed that it was not breaching the law because the system was covered under a Law Enforcement Directive and not GDPR. 

This effectively would have categorised the employment conditions of prison officers as being covered by a directive that is primarily concerned with detecting crime. The commissioner rejected this argument.

The first prison to use this system was Cork Prison, where it was introduced in 2015 — prior to the new GDPR laws coming into effect in 2018. 

The IPS had planned to roll out the system to all 13 prisons in the country. The upper value for the tender for the system in Cork Prison was €1.3m, which would render the total possible cost for the 13 prisons at around €17m.  

It is now unclear if this will now go ahead, following the ruling that the system is illegal.

In response to questions on the matter, the IPS has denied that Ms Dixon’s notification is a ruling or that the process carried out by the DPC over the last 18 months was an “investigation”.

“The DPC has made findings in respect of preliminary issues associated with a complaint that the DPC are handling which is associated with the provision of keys through an automated vending process," it stated. "The complaint is still open, and as such our response to your query is limited to what is appropriate on the basis of the ongoing process.” 

The IPS statement added that it was considering the findings. There is provision in the ruling for an appeal to be made within 28 days. The IPS also stated that the system is operational in Cork and Castlerea only.