Irish Examiner view: Privacy right but also the public good

Department of Social Protection in the dock over public services card data gathering

Paschal Donohoe registering for a public services card in 2016. The Department of Social Protection was this week found to have infringed GDPR in a case concerning use of card data. File picture

By now, anyone with half an eye on current events is accustomed to news of tech companies misusing users’ personal data.

Hardly a week goes by, it seems, without some social media giant or other being fined millions for data breaches, a repetitive trope which makes one wonder whether lessons are being learnt at all.

We saw a slightly different version of the misuse of data narrative this week, with the Department of Social Protection in the dock for infringing the General Data Protection Regulation (GDPR). The Data Protection Commissioner has found that the department failed to notify a complainant when they received their public services card that if it was used as a free travel pass, then the user’s personal data could be transferred to the department.

This could serve as the dictionary definition of a breach of a citizen’s right to privacy, but there are also wider societal implications. A case such as this provides fuel to conspiracy theorists who are hawking notions of State intrusion and overreach, while even among those with a more measured view it is a blow to public confidence in the operation of State agencies.

A key difference is that the data is not being used for commercial purposes, which is a significant issue when it comes to large tech companies’ scraping of users’ data. 

Legal experts have observed that that may become a central distinction if the complainant in this instance, Martin McMahon, proceeds with a court case. 

Those experts have pointed to cases in Britain where damages were more likely to be forthcoming when data is sold on for profit, which has not occurred here.

However, there are important lessons here for bodies such as the Department of Social Protection, such as the principle of data minimisation: in short, such agencies should collect only the data that is necessary, and that data should be kept for as long as necessary and no longer.

If State agencies learn that lesson this case will have been of no small service to us all.