Mr. Simon McGarr:

On the specific question in respect of the public services card, it does have a great deal of the appearance of a national ID card scheme in its scope, and that scope is increasing regularly to the point that one is no longer able to apply for a driving licence for the first time without having a public services card. People who are applying for their first passport must first take up a public services card. That is a subsection of a wider question, which is relevant to the Bara judgment, which is that the State has taken many concrete steps in recent years to build not merely an ID database of which the public services card is the physical manifestation but also a series of national databases intending to capture not merely all citizens' data but also data on people travelling through the State by way of the passenger name recognition database, PNR, and on all residents, who may not necessarily be citizens, of course, by way of the individual health identifiers database. On each occasion that these steps have been taken, provision has been made to take the data which has been collected from individuals by other agencies for other purposes and apply it to this new purpose, this data-sharing between bodies. This is again exactly the matter that was before the Court of Justice of the European Union, CJEU. It is again exactly the matter in which the Romanian Government was found to have acted unlawfully in transferring its data between its equivalents in Romania of our Department of Social Protection and Revenue Commissioners. It seems to me that despite the Data Protection Commissioner producing an excellent briefing note for the State on these matters, there has still been, shall we say, executive reluctance to absorb fully the lessons of what European law states on the limits of state data-sharing.

Nonetheless, what we can see here and in other recent proposed legislation, including the proposed data-sharing Bill, is that there is an effort by the State to continue to provide a backstop for its projects that are under way and on which a great deal of money has been spent while at the same time not fully addressing head on the question of citizen's rights in respect of data-sharing. That is not an attractive way for the State to have acted. In particular, notwithstanding the very legitimate reasons there may well be, for example, in the health sphere, for creating databases which can contribute to public safety and to health safety, the level of trust that is required to allow databases of that sort to be built must be built first on the understanding of the citizenry as to what is being done and must be built up in order that they know it is being done in the right way and that they trust it is being done in the right way. Internationally what we have seen is that if trust is not built first and there is an administrative push to collect the data and explain it to people later, very expensive and substantial projects fail completely. I am thinking of the NHS care.data project, which was a centralised health records scheme that failed completely after the expenditure of million of pounds sterling in the UK as a result of a basic failure of public trust in how the data were going to be managed. I am thinking of the Australian identity card scheme and public identity register which effectively came to creaking halt once the Australian people lost trust in the scheme as it was being provided for.

These matters are not tidying-up matters. It is not a matter of going back and explaining it to people afterwards. If trust is not built into the scheme from the start, if the necessary explanations cannot be provided, and if people do not think their legal rights to their data privacy are being respected, potentially very valuable public schemes become hamstrung from the very start. It is not merely counterproductive from an administrative point of view and in terms of the loss of time and money. It is also very destructive of the relationship between the state and the citizen.