Data Protection Commissioner has marked Government's card with PSC outcome 

The Public Services Card may still exist, but it cannot be made mandatory for anything.

It is hard to understate the importance of what happened on Friday with the long-running Public Services Card (PSC) saga, nor to view it as anything else other than a massive win for Ireland’s beleaguered Data Protection Commission.

To recap, the PSC has been around since 2011 when it was introduced as an identification tool for citizens to access welfare payments and services.

In 2013, the then Government decided in a decision on its eGovernment strategy to emphasise data sharing between departments and to expand the PSC across the public service. That expansion began in earnest in 2016, driven by the Department of Public Expenditure and Reform. 

Plans were in train for the card to be mandatory when: applying for driving licences and theory tests; applying for student grants; accessing online health portals; submitting school transport appeals, and a lot more.

In early 2018, the Road Safety Authority announced that having a PSC would become mandatory for obtaining a driving licence, only for the requirement to be dropped by transport minister Shane Ross over legal concerns just two months later (but not before the RSA had spent €2m getting ready for the change).

By then, the Data Protection Commission (DPC) had already been investigating the PSC project for several months over concerns about its compliance with privacy law ahead of the GDPR going live in May 2018. That investigation came to a head in August 2019, 22 months later, when the DPC ruled that making the PSC a prerequisite for State services (first-time passport applications having been the most recent addition to the mandatory PSC roster) had “no lawful basis”. 

It ordered Social Protection and other State departments and agencies to stop doing what they were doing.

Social Protection, however, said it did not agree with the rulings. The DPC moved to officially enforce them. The department responded with its court appeal, what most perceived would be the first step in a three-year journey to the Court of Justice of the European Union. The dropping of that appeal on Friday is a watershed moment.

How can this be seen as anything other than a loss for the Department of Social Protection? 

When it first went to court, the DSP and its then minister Regina Doherty insisted they had the strongest possible legal advice that they were in the right.

Last year, this writer was in court for one of the most bizarre hearings he’d ever seen, where the Department of Social protection argued that the DPC was sabotaging the legal process by submitting legal documents which were too long. 

If you’d told me then the issue would eventually be settled I wouldn’t have believed you. Has somewhere along the line someone said quietly 'if you take this on you’re going to lose, and if losing is inevitable you’re better off doing it now’? Maybe we’ll never know.

Regardless, while the department says it is “pleased” with the “agreement” reached, here’s why the DPC can be quietly euphoric with what has transpired.

To start with, its entire 2019 report now finally stands unchallenged. It is no coincidence that the commission immediately published it on its website, something it has wanted to do for more than two years (the department had previously released the report, having come under intense pressure to do so when it said it would be challenging its findings). 

To underline the point once more, the DPC’s findings are now binding. The card may still exist, but it cannot be made mandatory for anything. The appeal is gone. In that context, it’s not logically possible for both sides to be happy. The DPC has won, it’s that simple.

Furthermore, the investigations of the PSC (there are at least four) are far from over. 

The DPC had been looking at the alleged biometric properties (such as photos recognisable by digital recognition software – such processing is unlawful under GDPR) of the card in tandem with its already published investigation. 

That report had been due for publication by December 2019, but the Circuit Court legals stopped it in its tracks. There is nothing to stop it from finishing now, and should the card and its photo be held to be biometric the whole €98m project could be in big trouble.

Finally, after months of highly adversarial (and not always entirely fair) headlines regarding the perceived toothlessness of its regulation of big tech, the DPC has a significant win to pin to its lapel.

The dropping of the Department of Social Protection’s legal challenge to the DPC may indeed represent a seismic shift in the Government’s attitude to data protection, one of the key modern concerns for most western democracies. If it does, it will not be before time.