Data Protection Commissioner raised repeated concerns with Mother and Baby Home Commission

Data Protection Commissioner raised repeated concerns with Mother and Baby Home Commission

The graveyard at the former mother and baby home at Bessborough, Cork. There are now questions over the handling of sensitive survivor testimony and delays in responding to queries
File picture: Laura Hutton/RollingNews.ie

The Data Protection Commissioner (DPC) wrote repeatedly to the Mother and Baby Home Commission raising concerns about the handling of sensitive survivor testimony and delays in responding to queries.

The DPC said it was “disappointed” that the commission had not quickly responded to one of its letters and warned that failure to respond to its concerns could be a breach of their duty of co-operation under data regulations.

In response, the Mother and Baby Home Commission said it had been given insufficient time to deal with the queries and said issues were being “conflated” in the letters.

The DPC said answers to its concerns should have been “immediately to hand” and that the tight deadlines were necessary given the commission was going to be wound down at the end of February.

A letter said: “This of itself, unfortunately, raises issues about the commission’s compliance with its GDPR obligations.” 

The DPC also noted that “a number of queries have regrettably not been responded to” and said lack of clarity on managing witness evidence was “due to a lack of information from the commission”.

In the correspondence, released under the Freedom of Information Act, the DPC raised a series of concerns over how redaction of records was being undertaken.

It also asked the commission why it had not temporarily paused redaction of records as had been requested by the DPC.

In one letter, it raised queries over what the commission had described as “personal dictaphone recordings”.

“Do you mean that the notetaker had their own dictaphone (or similar recording device) provided to them by the commission, or that they recorded witness testimony using their personal mobile phone or other personal device that was not in the control of the commission?”

Among other concerns raised was a standardised letter to witnesses who had requested redactions to the evidence they had given.

They wrote: “That letter does not provide the witness with any details of the records which are within the scope of a redaction request and does not provide them with access to those records.” 

The DPC said its understanding was that some witnesses would need to see the records to understand what had been written down in evidence.

It said while legislation covering the commission appeared “purports” to restrict people’s rights under the GDPR personal data regulations, this could not be done in a “blanket fashion”.

The DPC letter states: “It is also important to note that redaction and/or erasure of personal data is an act of processing that is regulated by the GDPR, and which therefore must be carried out in compliance with the GDPR.” 

The DPC also sought clarity on how witness testimonies were recorded and where they were stored, in the correspondence from January.

It asked about copies of electronic recordings and said it wanted to know what would have been the “lawful basis” for any destruction that took place.

The DPC also warned of the possibility of information relating to the children of mothers at the homes being permanently and irrevocably lost.

It asked for a list of rules and guidelines that were being used for management of that data, and for all the redactions the commission planned to make.

The DPC also raised concerns about transferring the mother and baby homes archive to the children's minister and how that was being managed.

It said “time [was] of the essence” in getting answers to their queries as the commission was to be wound up by law at the end of February.

In another letter to Children's Minister Roderic O’Gorman, Data Protection Commissioner Helen Dixon reiterated those concerns, saying it was “urgent in light of the commission’s forthcoming dissolution”.

She said a whole range of matters remained “unclear” and that they had asked the Mother and Baby Home Commission to suspend its redaction process pending clarification.

Ms Dixon wrote: “I should also note that my office has started to receive complaints from data subjects relating to the commission’s data processing and its approach to data subjects’ rights.” 

In a statement, the Department of Children said at the time of the correspondence, the commission was the data controller for the records.

However, it had now fulfilled that role. “[Our] officials have engaged regularly in recent months with the Office of the Data Protection commissioner to continue to share updates on progress being made by the department and to discuss some of the more complex matters concerning the archive.”

More in this section