Oireachtas Joint and Select Committees
Thursday, 21 November 2019
Joint Oireachtas Committee on Social Protection
Public Services Card: Minister for Employment Affairs and Social Protection
Good morning everyone. As we have a quorum we will begin our meeting in public session. I ask everyone to turn off their mobile phones or switch them to flight mode. There will be no private session today. We will deal with any matters arising at our next meeting. I welcome the Minister for Employment Affairs and Social Protection, Deputy Regina Doherty, and officials from her Department to the meeting. In a moment I will invite the Minister to make an opening statement and then members will have an opportunity to pose questions.
I draw everyone's attention to the fact that by virtue of section 17(2)(l) of the Defamation Act 2009, witnesses are protected by absolute privilege in respect of their evidence to this committee. However, if they are directed by the committee to cease giving evidence on a particular matter and continue to so do, they are entitled thereafter only to qualified privilege in respect of their evidence. They are directed that only evidence connected with the subject matter of these proceedings is to be given and are asked to respect the parliamentary practice to the effect that, where possible, they should not criticise nor make charges against any person, persons or entity by name or in such a way as to make him, her or it identifiable. Members are reminded of the long-standing parliamentary practice to the effect that they should not comment on, criticise or make charges against a person outside the Houses or an official either by name or in such a way as to make him or her identifiable.
I now invite the Minister to make her opening statement.
I thank the Chairman and members for the invitation to attend this morning to discuss the public services card, PSC. I am looking forward to the questions of committee members on what is a very important topic. Before discussing the public services card, it might be useful to give a brief overview of the history of the card, the background to the recent report by the Data Protection Commission on the card and the developments since the report was published on 17 September last.
The public services card has its genesis in the 1990s and its purpose has always been clear, namely, to provide a means of verifying a person's identity when accessing public services. In December 1993, the then Government approved in principle the development of an integrated social services system, ISSS, which would provide a more integrated approach to the administration, delivery, management and control of statutory income support services. An interdepartmental committee was established to progress that initiative. That committee made a number of recommendations that were subsequently implemented, the main objectives of which were to improve customer services, provide value for money, and modernise the public service and the way it carries out its work on behalf of the citizens of our State. The committee recommended that legislation be introduced to allow the then revenue and social insurance number, RSI number, to be adopted as a single public service identifier. It also recommended that the use of the social services card be expanded across the public service to support customer identification, speed up access to social services and support new electronic payments. It also suggested that the card should include a photograph of the customer to facilitate identification when he or she availed of public services.
These recommendations were published in a 1996 interdepartmental report and formed the basis for measures taken by one of my predecessors in this Department, the former Minister for Social, Community and Family Affairs, Deputy Dermot Ahern, in February 1998. He introduced legislation in the Dáil to provide for the standardisation of the RSI number as the personal public service number, PPSN; the replacement of the social services card by the public services card, which would have the person's name, PPSN and the card number visible on the front; and the use of new technology on cards to develop new methods of paying social welfare benefits. The Government made it clear at the time that both the public services card and the PPSN were to be used widely across the public service to assist people in their dealings with public sector organisations.
Subsequent Governments progressed this policy and introduced a small number of further legislative amendments, providing, for example, that the Minister would not issue a PSC unless he or she was satisfied as to the identity of the person to whom the card was being issued, and that the person's photograph and signature would be included on the card.
Following the development and implementation of the standard framework for authentication of identity, the standard authentication framework environment, SAFE, public service cards were first introduced in 2011. The PSC is now widely used by a number of bodies as a means of identification. These bodies include my Department, the Revenue Commissioners, the Passport Office, Student Universal Support Ireland, SUSI, the National Driver Licence Service and the Irish Naturalisation and Immigration Service. In practice, this means that once a person has authenticated his or her identity via the SAFE process and has been issued a PSC, that person does not have to submit the same information to authenticate his or her identity each and every time he or she makes an application to any of the bodies that use that card. There are more than 3.2 million active users of the PSC, representing more than 80% of the adult population in the State. In this context, it should also be noted that, each week, payments valued at approximately €150 million are made via our post offices by more than 600,000 people, whose identity is verified on each occasion by using their PSCs. Every week, approximately 600,000 free travel journeys are made using the PSC. Every year, approximately 70,000 people over the age of 18 apply for a passport for the first time using their PSC to avoid having to resubmit identity data. Almost 420,000 PSC holders have verified their identity to a standard that enables them to access a wide variety of online services with the bodies mentioned via MyGovID. The development of the PSC has been welcomed by the public. Research commissioned by my Department indicates high levels of satisfaction with the overall process among holders.
On 27 October 2017, the Data Protection Commission initiated an investigation into the Department's compliance with its responsibilities as a data controller in respect of PSC-related matters, including the legal basis for the processing of personal data and compliance with EU law. The Department fully co-operated with the investigation, including through the provision of detailed responses to a draft report provided to the Department at the midpoint of the investigation process. The final report relating to the legal basis and transparency issues contained eight findings and was received by my Department on 15 August 2019, together with a letter from the commission requiring the Department to take certain measures. The Data Protection Commission stated that it did not have the legal powers to publish the report but it issued a press release setting out the key findings and the measures that it required my Department to take. It requested that my Department publish the report of its own volition.
The commission found that my Department has the legal powers to require users of its services to authenticate their identity to SAFE standards, to issue a PSC to these users and to require them to produce it as a means of authenticating their identity when accessing Department of Employment Affairs and Social Protection services. It found that the right to issue a PSC did not extend to circumstances where the user was acquiring it solely for the purpose of transactions with other bodies in circumstances where these bodies did not offer their users an alternative means of authenticating their identity. It found that the Department did not have the right to indefinitely and on a blanket basis retain documents and other information collected for the purposes of authenticating identity. Finally, it found that the information provided to users in respect of the PSC did not satisfy transparency requirements.
My Department, together with the Department of Public Expenditure and Reform, considered the report carefully and we sought the advice of the Attorney General's office. Following this consideration, it was concluded that the processing of personal data related to the PSC complies with legal requirements, the document retention is lawful and the information provided satisfies our transparency requirements. The commission has advised my Department that an enforcement notice is being prepared which will be issued to the Department in respect of its investigation. My Department will carefully consider this notice when it is received and we will take the appropriate actions in light of the advice from the Attorney General's office, which may include referral to our courts. I look forward to hearing the committee's views and answering any questions.
The Minister mentioned legal advice from the Attorney General's office. I understood, when I raised this during parliamentary questions, that this had been farmed out to a third-party lawyer. Did this advice come directly from the Attorney General's office or an outside lawyer? I suppose it would be too much to ask who the lawyer was. We have not seen the legal advice. It may not be possible to do so because there may be some precedent for not publishing it. Can we at least have a synopsis of the legal advice? I have read the report carefully. It has been a while but I can read it again. It represents two years of research and I thought the legal reasoning was impeccable. How does the legal advice justify indefinite retention of data? Does it tell us that there is currently sufficient transparency and that the public is adequately informed about the use to which the data can be put? I am intrigued to find out if it provides justification in that regard.
The Data Protection Commission made a number of recommendations. Have any of those recommendations been adhered to yet? Is the Minister conscious that a number of other public bodies that were using the card have resiled from insisting that it be produced to grant people services? Her colleague, the Minister for Transport, Tourism and Sport, Deputy Ross, went so far as to say that his officials had been vindicated in having initial doubts about the legal validity of the card. We saw only yesterday that under the childcare scheme announced recently by the Minister for Children and Youth Affairs, Deputy Zappone, use of the card will come into play. Since the online system will not be ready until next year, people will have to wait because they will have to produce the card to access the scheme. Regardless of the recommendations of the Data Protection Commission and the all-party committee that the Minister spoke about, and regardless of what was or was not said in the Dáil, the Data Protection Commission has found that, legally, the legislation introduced in 1998 does not give the powers that are being claimed. The commission clearly found that the legislation does not allow public bodies other than the Department of Employment Affairs and Social Protection to insist on compulsory production of the card and that is the fact.
The Minister was vague about the enforcement notice. She has not yet received the enforcement notice, which is somewhat surprising. Can she be a little clearer in this regard? If the Attorney General or the Attorney General's lawyer has told her that everything is perfectly in order and she receives an enforcement notice, it follows naturally that she will contest the notice.
The committee's recommendations about the use of the card outside the Department of Employment Affairs and Social Protection seem to say that it can be used for purposes other than social welfare provided an alternative system is in place which people can opt to use if they wish. We on this side of the House recognise that the public services card has been very useful. I know many people in my constituency who prefer to access social welfare and some other services by just producing the public services card. It is very convenient. Our difficulty is that it is compulsory. We get that it is compulsory for social welfare but it has been made compulsory for a range of other services for which the Data Protection Commissioner says there is no legal basis.
I remind the Minister of the 2016 report of the Comptroller and Auditor General, which stated that no business case had been made for the card. The report points out that in certain cases, the card seems to make it more difficult rather than easier to access services.
There is no obvious justification that the card must be produced in appeals for refusals of school transport.
If I miss any of the 27 questions put to me, I appreciate that they were asked one at a time, I hope Deputy O'Dea will remind me. The advice we took came from our in-house legal team and the Office of the Attorney General, in which there are many legal minds. The Office of the Attorney General also took third-party advice. As a former Minister, Deputy O'Dea will be well aware of the seasoned practice that the Office of the Attorney General is the Cabinet's adviser. Its advice has never been published so there is precedence for it being between the Attorney General and his or her client which in this case is the Government. I genuinely believe that all of my statements, including those I have made today, reiterate the strong legal advice from the Office of the Attorney General that the interpretation of the legislation by the Data Protection Commissioner is incorrect. Our understanding and belief is that the legislation enacted in 1998 by the Deputy's Government, the Government of 2005 and subsequently Fine Gael-led Governments in 2011 and 2013 empowers us to do exactly what we have been doing since the PSC was published in 2011. The synopsis of the advice is on the public record. The use of the data is something that we have clearly set out and established in the 2005 legislation. We believe that we are following the legislation to a T.
There was some misinformation about statements made and public commentary thereafter. A PSC is not needed to make a SUSI grant appeal, which is the one on which people keep relying to show how we were wrong. No one needs a PSC to make a SUSI grant appeal, that was never the case and there are no plans by the relevant Department or Government agency to make that the case. The Data Protection Commissioner did find that there was absolutely a legal base for the Department of Employment Affairs and Social Protection to require people to authenticate themselves during the stage 2 process so that we could be absolutely sure that they are who they say they are and that they are only registered to access public State services once, and once only, in their own name. Every other Minister has the right or entitlement in their own Department to determine how best they provide public services. The Deputy needs to recall why his Government had the foresight to do this in 1998 and why subsequent Governments continued with it. The idea was just to try to make access to public services easier, more efficient and quicker for the people we are here to serve. People have spoken with their feet insofar as the Deputy has admitted that, where they wish to do things online, it is much faster to use the PSC as proof of identity. The best example which most people can visualise is how one can get a passport by completing an application form online on Monday and receiving one's passport on Wednesday or Thursday. That would have been unheard of some years ago. However, it is not true to say that one cannot get a passport any other way because one can. It is not true that one cannot get a driver licence any other way than having a PSC because one can, but it is by means of the old, inefficient way. People can choose with their feet to decide if they wish to go to the post office, bring the photographs to the Garda station, get them signed, go in and sit in Mount Street for four hours or to just do it online. That is their choice.
It is incumbent on any Government to provide services in the most efficient way possible but also to give people choices depending on their circumstances. The childcare scheme is a case in point. There is misinformation circulating that we have only changed the childcare scheme since the Data Protection Commissioner's ruling came out in August. Since the inception of the childcare scheme 18 months ago, there were always plans for a paper application and an online application route, which is just what transpired since the scheme went live recently.
The Deputy suggested that I am vague on the enforcement notice. I am not sure if he means how I will respond when the enforcement notice comes. I am deliberately vague in this regard because the press releases which were issued by the Data Protection Commissioner on 15 August were incredibly strong, direct and robust. I now find myself some three and a half months later, having initially been instructed to do things within seven days, within 21 days and within six weeks, of having no sight of the enforcement notice that was imminent on 15 August. If I am being deliberately cagey it is because I genuinely have no idea what will be in the enforcement notice if it ever arrives. I have no idea if it will be exactly the same as the findings given that some of the opinions have changed in the last couple of months arising from the findings. I am not sure if it will be the instructions that came in the letter to us on 15 August which were different to the instructions that came in the findings. I am not being obstructive, I just do not know what will be in the enforcement notice. However, I guarantee that it will get as much careful thought and consideration in our response, if and when it comes.
The report of the Comptroller and Auditor General did suggest that there was a problem that we should have potentially a one-document business case. That was raised at a meeting of the Committee on Public Accounts either last week or the week before. The Department has acknowledged that there was no single business case document for the development of the SAFE identity process and the whole PSC project but that should not be taken as evidence that there was not a huge amount of planning over many years by successive Governments over the years and Departments. Most of the elements of the business case were in place in various documents that were laid before the Committee of Public Accounts. I have a document that I can give the Deputy today that lists 22 different documents which detailed exactly how, when, where, why and the purpose of what we were trying to do. In hindsight, perhaps it would have been better had we started on day one with one document with 20 chapters but that is not the way it happened. That was acknowledged by the Secretary General last week, that if we were to start from the beginning we might have one document. However, just because there was not one document that does not mean that there were not 21 documents detailing all the facets.
Finally, I have had the privilege of holding this post for several years and have received legal advice on many matters. The legal advice I have from the Office of the Attorney Genera is as strong as it could be. We have a difference of interpretation of Department of Employment Affairs and Social Protection legislation. Our interpretation of our legislation which was passed by successive Governments is correct. The advice is that the Data Protection Commissioner interpretation of our legislation is incorrect. We have a simple case of two people interpreting legislation in a different way. The Data Protection Commissioner is doing her job and we are doing ours. We will take our next move after the Data Protection Commissioner has made its next move.
The Minister has answered some of the questions and has been misleading on others. I will return to that. This has been a shambles from day 1. The Department's handling of the Data Protection Commissioner's entire investigation, and even the format in which some of the material was sent to the investigation. I will not dwell on that as there are more important questions for which I require answers. This was the first investigation but another is ongoing onto biometrics and the card. What stage is that investigation at? Has the Minister engaged with the Data Protection Commissioner on that? Has it furnished the Department with a series of questions and areas on which it seeks clarity or further information? Has the Minister seen a report or draft stemming from that?
No, I will rattle on if the Chairman does not mind. The Minister spoke of the incredibly strong advice received from the Office of the Attorney General that the card is legal under all circumstances which she outlined. This is the same Attorney General who briefed the Minister for Transport, Tourism and Sport, Deputy Ross, and his officials and whose advice led to the withdrawal of the mandatory requirement to use the PSC for the test for the driver licence.
The Minister mentioned taking two different interpretations of legal advice but does the Attorney General have two different interpretations of the legal status of the PSC? He seems to give two versions of what is legal. The Minister stated that she has received incredibly strong legal advice from the Attorney General and the Minister for Transport, Tourism and Sport, Deputy Ross, has indicated that he and his officials have been vindicated in the position they have taken to withdraw the requirement relating to PSCs following advice from the Attorney General.
Does the Minister truly believe that challenging the Data Protection Commissioner will have absolutely no repercussions in how multinationals based here will deal with the Government? There are genuine concerns around that. Does the Minister firmly believe there will be no such repercussions? The Minister is challenging the very strong ruling of the Data Protection Commission relating to the retention and sharing of data linked to the mandatory nature of the PSC. How far is the Minister prepared to go with this and how much of the taxpayers' money is she willing to waste in challenging the ruling?
The Minister indicates that the legal advice she received was in-house and we know the Attorney General had third-party legal advice. What formal questions were asked of the Attorney General by the Minister when her Department was considering the Data Protection Commissioner's report? The Minister mentioned in-house legal people but what qualifications do they possess? There are probably six Irish barristers who qualify as being legally expert in the field. It is quite interesting that all of them have said-----
In case the Deputy is not aware of it, there are two investigations that have been commenced by the Data Protection Commission with regard to the PSC. The first investigation had three modules, of which two have been reported upon; the resulting report came from the Data Protection Commission on 15 August. The third module in the first investigation is still outstanding. I am not aware that the second investigation, which concerns biometrics, has commenced because we have received no questions, queries or a draft report from the Data Protection Commission. We await any requests that would come from there on that.
As stated earlier, the advice given by the Attorney General to my Department is as robust as it potentially could have been. It is very strong ins that the legal basis that we have to support what was exactly initiated and desired as far back as 1998 is as we are doing now. The advice is so strong as to say that if we deviated from what we are doing and from the practices in my Department and other Departments, we would be in breach of legislation passed in 1998 and 2005. There are not two different views. With respect to the statements made by the other Minister for Transport, Tourism and Sport, I suggest that the Deputy ask him what exactly he sought legal advice on and what advice was received. He certainly did not ask for legal advice on whether he had the legal authority to mandate the National Driver Licence Service to look-----
I am suggesting that the Deputy might query exactly what legal advice was sought. The Minister definitely did not receive any legal advice on the legal status or basis for requiring people when using mygov.ieto have a PSC.
I truly believe that challenging the Data Protection Commissioner is okay. I am not sure if the Deputy was here when the House passed the legislation relating to the establishment of the Data Protection Commission and its responsibilities. When we passed that legislation, as is standard practice with any judicial or semi-judicial authority, we made a provision that if somebody received a ruling that he or she did not agree with, there would be a legal right to challenge that ruling and defend himself or herself. That is all we are doing. Legislation was enacted or amended in 1998, 2005, 2011, 2013 and 2015 and we believe this vindicates and defends the Government's provision of our services in an efficient and fast manner.
The only reason the PSC was established was to allow our citizens - the people we are here to serve - get access to services and interact with the State in the most efficient manner possible. If the Deputy is suggesting we should not defend successive Governments' attempts to make it easier for the citizens of the State to do business with the State, I am not sure what is the basis of his argument.
We will go as far as it takes to vindicate the position. We believe we have both the legal right and authority to do exactly what we have been doing since the first PSC was issued in 2011.
It is probably standard practice for most Departments to have in-house legal advisers. We have two and both are barristers who have been seconded from the Attorney General's office. They reside in the Department of Employment Affairs and Social Protection but they are staff of the Attorney General's office.
We did not ask formal questions. We gave the final report to the Attorney General and this is exactly the same as when we consulted extensively when we got the draft report in November 2018. In the preparation of the response to the draft report, both the Attorney General's office and officials from the Department of Public Expenditure and Reform would have been heavily involved. I did not ask about qualifications in the Office of the Attorney General. It is an established authority that has been around since the foundation of the State. It is there to advise Governments on how they should run their business.
I thank the Minister for attending. We have been looking forward to this for a while. The Data Protection Commission's report vindicates much of my thoughts about the PSC from the very beginning. Many people feel that this is a national identity card introduced by the back door and that the Department of Employment Affairs and Social Protection, having established it for its own services, has expanded it across the board into other services.
From the eight findings in the report of the Data Protection Commission, three relate to the legal basis and the remaining five relate to transparency. The report indicates that the processing of certain personal data by the Department in connection with the issuing of PSCs for the purpose of validating the identity of a person claiming, receiving or presenting for payment of a benefit has a legal basis under applicable data protection law. It goes on to state that the processing of personal data by the Department in connection with the issuing of PSCs for the purposes of transaction between individuals and other specified public bodies other than the Department itself does not have a legal basis under applicable data protection laws, and that, specifically, such processing contravenes section 2A of the Data Protection Acts 1988 and 2003. Has the Minister responded to the Data Protection Commission on that matter?
The report also indicates that the Department's blanket and indefinite retention of underlying documents and information provided by persons applying for a PSC contravenes section 2(1)(c)(iv) of the Data Protection Act 1988 and 2003 because such data is retained for periods longer than is necessary than the purpose for which it was collected.
Has the Department responded to the Data Protection Commission on that issue to clarify the Department's legal point of view?
In terms of transparency, the scheme does not comply with section 2D of the Data Protection Act 1988, as amended by the Data Protection (Amendment) Act 2003, in that the information provided by the Department to the public about the processing of their personal data in connection with the issuing of PSCs is not adequate. Has the Department responded to the Data Protection Commission?
The Data Protection Commission went to state that, critically, the Department will be required to complete the implementation of two specific measures within a period of 21 days. Have those two specific measures been implemented, yes or no? The first of the two measures was set out as follows:
It will be required to stop all processing of personal data carried out in connection with the issuing of PSCs, where a PSC is being issued solely for the purpose of a transaction between a member of the public and a specified public body ... . The corollary of this finding is that bodies other than DEASP cannot insist that a person who does not already hold a PSC must obtain one as a pre-condition of accessing public services provided by that body.
Has the Department responded to and implemented that measure? The second required measure was:
The Department will be required to contact those public bodies who require the production of a PSC as a pre-condition of entering into transactions with individual members of the public, to notify them that, going forward, the Department will not be in a position to issue PSCs to any member of the public who wishes to enter a transaction with ... any such public body.
How is the Department implementing those two points?
There is another question I want to ask the Minister before I finish up. The Minister stated in her introduction that each year, approximately 70,000 people over the age of 18 apply for a passport for the first time using a PSC to avoid having to resubmit identity data. The Minister is saying one can go the old route of getting one's two photographs, etc. Has that been the case in all circumstances? Maybe the Minister can also clarify the following point for me. I have read that one needs to have a public services card to apply for the national childcare scheme. Is it correct to state there is an alternative paper application process but that does not start until January and there is no back payment? If I am correct, it means that the Department's system discriminates against those who do not have the public services card. Those are the main points I wanted to ask on the issue.
Many people have sought under freedom of information, FOI, legislation all of the documentation regarding meetings of interdepartmental groups right back as far as 1996. At no stage was there ever any indication or action arising from the thought process that there would be any legislation passed or anything to give anybody the impression that this was a national identity card by the side door, the back door or the front door. That fear, while real for a small number of people, is unfounded.
For the record, there is an assumption that members of my party have a great wish to have a national identity card. I would abhor anybody walking down the road or anywhere being stopped and asked to produce papers. It has massively negative connotations for me and I would not be able to support anybody who wants to introduce it. Regardless of whether we have a national debate about it, which is what people keep calling for, I would not agree, sign up and subscribe to a policy that would introduce a national identity card. For the record, I do not agree with it.
There were eight findings. The difficulty I have in answering the questions without sounding like a smart-arse is that none of the eight findings has any force in law. There is no enforcement notice and since 15 August, none has been issued as of yet. I have nothing to challenge other than to say to the Deputy that I do not agree with any of the eight findings, not even the first one. While that might sound bad, I do not have the ability to do anything other than wait.
It was never the case that the instructions that were given to us to be complied with in seven days, within 21 days and, in the final instructions, within 60 days, were ever to be complied with because we do not agree with them. My legal advice is that the interpretation of the legislation by the Data Protection Commissioner's, DPC's, office is incorrect. In fact, the advice we have been given is that if we did any of the things we were instructed to do, we would be acting outside of the legislation and effectively breaking the law. While it might seem disrespectful, I find that we are in limbo. Had the enforcement notice arrived on 15 August, we would have taken our time to look at it, get all of the advice and look at all of our practices over the past 20 years. We do not have anything to legally challenge and until I have something to legally challenge, the eight findings that were issued in the report - the instructions that were issued in the DPC's letter - do not have any legal force and we will not be enacting any of the instructions. If and when an enforcement notice is issued, we will consider carefully the instructions in that enforcement notice. If there are things in it with which we agree, we will comply. If there are things in it with which we disagree, our only recourse to challenge that is through the courts.
The Deputy asked about the photograph and the passport, as to whether one had the ability to get the passport by means other than having a PSC. One always had the ability to go the old route. That has never changed. That is to facilitate people of all walks of life who do not necessarily like technology. There are lots of people who still do not even send text messages. We need to be able to provide public services in the manner that people expect to be able to use. The most efficient manner for most people these days is online, which is why we have 3.2 million active users of the PSC and hundreds of thousands of people on a weekly basis who use it to get public services in a more efficient manner. However, all other routes to be able to accommodate other people should be facilitated by each and every Department. At the end of the day we are here to serve, not to control.
The Department is only the data controller of all of the data that are stored. I do not have the directive powers to tell other Ministers how to draft and run schemes that come out of their offices but the governing responsibility allows them to ask people. If people want to do business with the State online, they must be able to prove their identity and the most efficient way to be able to do so is through the SAFE 2 registration process, as 3.2 million people have found.
Lastly, the national childcare scheme was always in its foundations to have two ways to apply for it. One was to be paper and one was to be online. In order for one to make an application online through mygov.ie, one needs a PSC. Some 80% of those who will qualify for the childcare scheme subsidies have already got a PSC and the paper form is going live on 1 January. The Deputy is correct in stating that there is a month of a difference between the online version and the paper version.
I have a general question. The Data Protection Commission believes the Department is in breach of section 2A of the Data Protection Act and so forth. There are three legal issues where the Data Protection Commission suggests the Department is in breach. The Minister's legal advice is that the Department is not and she has sought that advice. Has the Minister, at any stage, with her officials, considered amending that legislation to bring better clarity to it to address the issues of concern to the Data Protection Commissioner?
To be honest, there has been some criticism as to why it took us as long to respond to the original findings on 15 August. There was some flurry of activity around 15 August and I think people expected us to either comply within two days or to respond within a number of days.
The issues here are complex and the legislation has been amended many times. The Chairman will be aware that with consolidated legislation one must look back etc. We considered everything to the nth degree right up to whether there is any possibility that we can strengthen the legislation. At the end of the day, we do not want to fight with a Government agency. If there was a way that we could have complied with the spirit of what the DPC was trying to do, we genuinely would have done it. We looked at the legislation and the advice from our drafters was there was no way to be clearer in what we are trying to do than what was already stated specifically in the legislation. In answer to the Chairman's direct question, we looked to see whether we could but the advice from the drafters was that it cannot be any clearer than it is.
Deputy Joan Collins asked me whether we responded to the DPC with regard to the seven days or 21 days. My Secretary General and I have written numerous letters to the DPC in recent months seeking clarity on the difference between the instructions in the letter and the instructions in the findings. We also requested meetings to find out exactly what the thinking was behind some of the instructions to see if we could find a way of avoiding going to court and to find some way of continuing the process of providing efficient services for all our people. We recognised the concerns the office of the DPC had raised and wanted to see if there was any way to assuage those concerns. We received no responses to our letters and the meetings were refused. I am not trying to be humble, and I know people probably will not believe this, but I respect the office of the Data Protection Commission and I have a particular respect for the lady who holds the single role of our regulatory authority. Neither I nor my Department want to be in conflict with her. We tried as hard as we could to find an amicable resolution but in the absence of having anything to legally enforce, I have no choice but to say that we will robustly defend our legal standing and the legislation of successive Governments. We will do exactly what we had intended and set out to do, which is to provide public services in an efficient manner.
I thank the Minister. In her presentation, she gave much detail about the 1990s but we skipped very quickly from 2017 to 2019, during which time many things were happening. I have looked back at my own engagement with the Minister on this issue at that time, when many others also engaged with her. In December 2017, I urged a period of slowing down and caution. I asked that the Department would try to stop digging in respect of the public services card and creating trouble for us as a nation so as to avoid leaving us as hostages to fortune. As an investigation had begun at that point, it would have seemed a good time to slow down but instead the Department doubled down on the roll-out. In February 2018, when questions were being asked, Mr. Duggan from the Department said he did not believe the fact that an investigation had begun necessarily meant the DPC had concerns. In December 2018, the Minister stated:
I cannot allow the Senator put on the record of this House that the Office of the Data Protection Commissioner has grave concerns with the Department of Employment Affairs and Social Protection. It does not.
The Minister had received the draft report at that time, which noted concerns about the retention of information, about which I will talk some more. The Minister can surely understand why giving a sense of the mood of the Attorney General's advice or what she feels might have been said is not satisfactory to us. We have been given assurances as to the general mood or tenor of an engagement that have not been backed up and which have effectively been contradicted by later revelations of the grave concerns raised, to which the Minister had access and we did not. In 2018 a new contract was signed for a new roll-out while this investigation was under way. These are serious concerns because many decisions were taken not to exercise even a modicum of caution for any period, not only as regards the contracts that had already been signed, but the new contracts as well.
I will group a few of the findings and go back to some others. Finding No. 3 stated "the blanket, indefinite retention of personal data consisting of documents and information (other than the applicant’s photograph and signature) which are originally collected for the purposes of identity authentication in the context of SAFE 2 registration is in contravention of DEASP’s obligations". Some 3.2 million people have gone through the SAFE 2 process and satisfied the Minister as to their identity. Not everyone has gone through the process but that is a separate issue. According to Mr. Duggan, the PSC is the token which shows that someone has gone through that process and successfully verified his or her identity to a substantial level of assurance. The Department satisfied itself as to their identity. Why is it retaining their documentation?
I do not know whether the Senator is aware that some challenges were made to the Ombudsman's office last year regarding decisions made on appeal for a variety of scheme applicants. The Ombudsman's office overruled decisions that had been made on appeal by our deciding officers because we did not have the relevant supporting documentation for those decisions. We were instructed that if we did not keep the supporting documentation, we would not be able to stand over the decisions made thereafter. Our office retains people's proof of the identity at the time of their application. When somebody else makes an application or submits a second PSC card application, we refer through the system for all that person's supporting documentation. In order to be able to identify and authenticate somebody who tries to apply a second time, we need to be able to reference the documents they used in the first instance. That is the reason we retain documents, and the problem-----
-----the Data Protection Commissioner had was not that we were retaining the data, but that we were not making a business case for the indefinite retention of the data. We do not indefinitely retain data; we retain them for as long as a recipient is doing business with our Department. That may be a number of years or sometimes longer, but it entirely depends on the recipient's relationship with the Department of Employment Affairs and Social Protection.
Nonetheless, findings Nos. 3 and 8 refer to the issue of the blanket and indefinite retention of data. The Minister is saying that is solely for the purpose of the Ombudsman but there is a lot of detail in it. For example-----
With respect, the reason neither of those findings have been implemented is that we do not agree with them. We believe we have complied with all our transparency obligations, and that we have the legal ability to retain data because they are required by us. That has been borne out by appeals to the Ombudsman's office which were overruled because we did not have supporting documentation.
I will give two examples of data being retained. The issue of applicants' mother's maiden names caused considerable distress to adopted persons who had to go through that process, which we discussed in this committee previously. That information is retained. Does the Minister believe that is proportional or necessary?
The difficulty I have with answering that question is that the data referenced by the Senator have not been questioned by the DPC. The data under question by the DPC are the proof of address. When citizens come in-----
The information to which the Data Protection Commission is specifically referring is the proof of address of people making applications, which is held on record in our Department. If someone comes to an interview for a PSC SAFE 2 authentication process with an ESB bill that states that he or she lives on No. 123, Road A, Rathfarnham, a copy of that ESB bill is kept on our records. That is the retention issue the Data Protection Commission has, insofar as it believes - incorrectly, in our opinion - that ESB bill should only be kept for a certain period of time, the length of which we should specify.
During proceedings in a High Court case this week, Ms Caitriona Bracken, who was formerly with the Department, said it was "an accepted work practise of the department’s management and staff to release information to Gardaí, solicitors and private investigators upon request". That related to the release of an address.
Does the Minister have concerns about the risks, from a personal data perspective, associated with the retention of addresses?
The member of staff in question said that the release of data was commonplace and that it was "an accepted work practice of the Department's management and staff to release information to Gardaí, solicitors and private investigators upon request".
With respect, the High Court case is ongoing. The witness in question is no longer a member of staff, arising from actions that were taken by said employee. For the record, in practically every county we have seconded members of An Garda Síochána as part of our fraud division. We share data with the Garda when criminal investigations are being carried out. We spoke a number of weeks ago about amendments that I made to the Criminal Assets Bureau legislation. The Senator was in the Seanad when those amendments were passed. Of course we share data with other Government agencies when we are legally obliged-----
Exactly. That is why I am stopping that discussion and moving on. The travel pass is another area of blanket indefinite retention. This is a serious concern. We have learned that the movements and journeys of over 1 million people who are on the statutory pension or have a disability are tracked.
No, my question is specific. Given that there were just 33 requests for this information to be sought by anybody, does the Minister believe that having that information accessible is proportionate or necessary? It is accessible by the Department.
It is necessary to determine how we pay our providers. If I do not know how many times people are using their travel passes, how can the Department or the State pay CIÉ, Bus Éireann, GoBus or Wexford Bus? The Senator is inaccurate when she says we know the data of people's travel journeys. If somebody gets on a train in Wexford, we know they have got on a train in Wexford and they have used their travel pass. That would be counted as one journey. I do not know where they get off or when they get off. I do not know if they get on a bus after they get off the train. We know that the travel card is being used from the first point at which it is used. The only purpose of keeping-----
The fact that the identity is known to the Department is part of the issue. The second, fifth and sixth findings in the report are of relevance in this regard. The sixth finding relates to people being clear about the consequences. The second relates to how people's data are used. The Data Protection Commissioner found that people were not adequately informed about how their data would be tracked and used. The introduction to the report makes it dead clear that this is not simply about privacy, or about who can or cannot identify someone. It is about control. A person's data is his or her data. My travel is my travel. The fact that I am going from place to place is my information. The fact that I go to Wexford every week is my information. It is one thing to know that someone has used the card. It is another thing to be able to track where someone has used it. The Minister has told us that it is possible to determine that it has been used in a certain place. There is an issue with adequate information. Does the Minister believe that every person who had to get a card in order to get a travel pass was clearly informed that the Department would be able to know about every journey he or she took and would be able to track that information?
I will be brief. The only way we have of knowing whether people have confidence in our use of their data is the results of the survey we conducted a number of years ago. The Senator may laugh and smirk-----
I am sorry, but the problem with the commentary here is that when we sit around in mediums like this, we refer to a very small number of organisations or individuals who have concerns. They are right to raise those concerns, as is the Senator. We never talk about the 3.2 million satisfied customers, or the 600,000 people who have absolutely no problem as they use their travel passes on a weekly basis.
If we agreed with the fifth finding, we would have done something about it. We do not agree with it. We believe there is enormous transparency in what we do, how we do it, when we do it and - most importantly - why we do it. That is borne out by the response to the data survey we conducted in 2017. There was 85% customer satisfaction across all of the questions that were asked. One of the questions related to the use of data.
There is a certain artificiality about the whole process. Some of the Minister's answers are disingenuous, to say the least. She responded to a question I asked about school transport by speaking about SUSI, even though I had not said a word about SUSI. I said there was an insistence that people appealing decisions on school transport would have to produce the PSC. That was the position, but it has now been resiled from.
With respect, anecdotal evidence is no basis on which to say that things were definitively going in a certain direction. It does more disservice to the Deputy to make such a disingenuous statement with no factual basis than it did to challenge me on the basis of supposedly being disingenuous.
Just a minute now. The purpose of the Data Protection Commissioner's investigation was to ascertain whether it is obligatory under the legislation for the Department of Employment Affairs and Social Protection to insist on the production of a PSC by those applying for social welfare. The purpose of the investigation we are talking about was to examine the attempt to extend that mandatory system to other Departments. Those responsible for issuing driving licences and passports, etc., were taking the view that they could also insist on the mandatory production of a PSC by those who wanted to avail of their services. The Data Protection Commissioner has said that this is not correct. When responding to Deputy Joan Collins and others, the Minister stated that people can now apply for passports and driving licences under the old system. People can do so now, but in the-----
-----absence of this report, this thing would have crept out into other Departments. I take what the Minister is saying about 3.2 million people being happy about the convenience of all of this. However, she is wrong when she says that the purpose of the Government's approach was to allow people to access services more efficiently. The purpose of the Government's approach was to force people to use the PSC to access services to which they would otherwise have been entitled. That is the position. That is precisely the matter on which the Data Protection Commissioner disagrees with the Minister. She said in response to a question asked by Deputy Brady that people who disagree with a legal ruling have the right to appeal. Of course they have. We all know that. As the Minister well knows, it is a gross oversimplification of the position to say that. The Data Protection Commissioner was set up as a statutory body to regulate data and to advise the Government on legislation concerning data, etc. When a statutory body of this nature, having been set up and paid for with millions of euro of taxpayers' money, comes up with a finding that the Minister is unhappy with, it is most unusual for her to rush immediately to her legal adviser. I am not sure whether the advice came from within the Department or from the Attorney General. I am not sure whether the Attorney General agreed with the in-house advice. I do not know where the third-party lawyer came into the picture.
Deputy Brady makes a valid point when he speaks about reputational damage. The Data Protection Commissioner is the European regulator for outfits like Google and Facebook. The Minister was highly condemnatory of the commissioner, a point I will return to in a moment. The impression that this confrontation could create among multinational companies is that if one of them disagrees with a finding of the Data Protection Commissioner, it can go to the Irish Government and the Government will see it right. In 2014, less than €2 million was spent on the Data Protection Commissioner's office. The figure now stands at €15 million, which gives a good impression that we are serious about data protection. However, this controversy is undoing that.
The Minister, in her response to me on a finding of the Data Protection Commissioner, was very condescending. She spoke of compliance with enforcement notices being required within a certain number of days and stated she had not yet received an enforcement notice. She said she would respond to the enforcement notice if it ever arrives. There is no doubt that it will arrive. My understanding was that the Minister was given 60 days to comply with some of the Data Protection Commissioner's requests. As such, it is not unreasonable that she has not yet received enforcement notices.
What is the position? Will the Government legislate in this area? Will it fight the Data Protection Commissioner through the courts? Will it accept, based on the fact that while the public services card is very useful and many people find it convenient and are happy to use it, those who do not want to use it for services other than social welfare should not be forced to do so?
My words of respect for the Data Protection Commissioner are on the record. What is not on the record is the Deputy's proof that we were making mandatory the sole use of a PSC for the provision of all Government services. I note with interest the Deputy's sniping and spitting at me that his Government did this and that. Given that it has been a long time since he sat at the Cabinet table, he may have forgotten that in 1998 and 2005 Fianna Fáil Governments brought forward-----
-----and the position he holds, I will not lower myself to be as rude to him as he has just been to me. The legislation that currently covers the DPC was voted on by the Fianna Fáil Party, which did not object to anybody in the State having recourse to taking objection to a semi-judicial body making a statement of finding against them. The State has done this on numerous occasions with an Bord Pleanála and many other Government and State agencies without reputational damage being done. Nobody says An Bord Pleanála has been undermined by the State because somebody took a case against it.
This is no different. The quasi-judicial rules and legislation that underpin the Data Protection Commissioner's office are exactly the same. I am not sure what the purpose of the Deputy's questions was. The Government legislation that has underpinned practice in this area for the past 20 years dates back to 1998 when it was introduced by the then Minister, Dermot Ahern. It was amended in 2005 by the Fianna Fáil and Green Party Government and again in 2011 and 2013 by the Department under a Fine Gael and Labour Party Government. This is not a case where the Deputy is good and I am bad. To return to the foundations of this process, the purpose of the card was to ensure that people who wanted to do business with the State in an efficient manner could do so. There is no bogeyman waiting to catch anybody out. As the Deputy said a number of times, people like this card. They like being able to deal with agencies of the State in an efficient manner and are doing so in their millions. People who do not want to identify themselves through our SAFE 2 registration process do not have to. There are other ways to access State services.
I will comment on the issue of the public services card being mandatory. The Minister indicated several times that people have a choice of using a paper-based system, for which they do not need the card, but that most people are happy to use the card. I acknowledge that. However, there was a shift in February 2018 when the Road Safety Authority, RSA, specifically stated that the public services card would be mandatory.
No, there was no alternative. Although the RSA subsequently changed its position, its initial statement of 20 February 2018 was that, as of 9 April 2018, all applications would require the public services card. Therein lies the problem. There was a policy shift by the RSA. I have not looked at all the other cases but I want to put that one on record. That was a specific change by the Road Safety Authority which initially indicated the use of the card would be mandatory before subsequently changing its position.
As I said earlier, as the lead Department that manages the data, we have a greater responsibility for implementation of the policy on the usage of the public services card than any other individual Department or line Minister. However, I do not have responsibility for telling the Ministers for Foreign Affairs and Trade, Transport, Tourism and Sport, Agriculture, Food and the Marine or Education and Skills or anyone else offering online services-----
The Minister has referred several times to paper-based methods and spoke about other Departments and users of the scheme. I am specifically showing that in this case a very clear indication was given that the public services card would be mandatory, although the position subsequently changed. I do not want to take up time with this.
That is fine and I do not want to split hairs with the Chairman. I am saying, however, that this never happened. A charge was made against me and the Government that we were trying to force everyone down a particular tunnel. That did not happen. As I said to Deputy Brady, I do not know what legal advice the Minister for Transport, Tourism and Sport received but he did not receive legal advice as to whether there was-----
In every contribution the Minister makes on the public services card she cites the 420,000 public service card holders as a massive success. She then refers to the 600,000 free travel journeys taken every week. She cites various statistics to back up her argument that the card is a massive success and says that is why people are using it. People had no alternative. The Chairman outlined the position regarding the driving test.
The Minister misled this committee on a number of occasions with regard to passports. Use of the public services card was a mandatory requirement for first-time passport applicants and applicants whose passport had expired more than five years previously. There was no alternative means of obtaining a passport other than having a public services card. That is a fact. The Minister needs to correct the record of the Dáil on this matter.
It was also a mandatory requirement - not just online - for anybody applying for naturalisation to have a public services card. Coincidentally, that requirement ceased on 16 August, the day after the publication of this report. Is that a coincidence? I do not think so. The Government took a fundamental position of forcing people to get a public services card to acquire these entitlements.
I questioned the legal experts that the Minister had looking at this matter. I raised the case of six Irish barristers, all of whom are leaders in the field as regards the general data protection regulation, who stated categorically that this is in breach of the GDPR. The Minister laughed at that which I do not understand. It is interesting to look at the freedom of information, FOI, requests that have been made and the information that has been provided. The Department seems to have a great regard for what these experts had to say, so much so that it virtually trolled Simon McGarr. Any contributions Mr. McGarr made online went back to officials in the Department to get a view and an analysis.
On the one hand, the Minister seems to be dismissing these experts-----
Deputy Brady asked if it is mandatory for people using the naturalisation service to have PSCs. It is not. It is mandatory for anybody applying for citizenship to have a PPS number. The only way to get a PPS number in the State is by going through my Department. We are all aware that the Data Protection Commission has said that I do have the legal basis to make people go through the SAFE 2 process. Words matter, and nuances really matter. The statement made by Deputy Brady is incorrect. The card was never mandatory for applicants to the Irish Naturalisation and Immigration Service in the context of undergoing the SAFE 2 process. It is only because they need PPS numbers, and for no other reason.
The Deputy is suggesting that I misled this committee. I have not done so, and I ask him to withdraw that slur.
The Deputy has made this suggestion with regard to the time when a person, over the age of 18 or otherwise, can apply for a passport and whether it is his or her first passport or one that has expired in the previous five years. For a person to apply online. he or she would absolutely need to have a PSC. How else would he or she identify himself or herself during the online process? During those periods, a person always had the ability to go to the local Garda station with his or her passport application, get it signed, get the photograph signed and arrive up to the office in Mount Street. I would respectfully ask the Deputy to withdraw the slur to which I refer and which he has made twice. In his opening statement - and before I had opened my mouth - the Deputy said that I had misled this committee, and he has done it again.
In terms of misinformation, the advertisement for the childcare scheme said that a MyGovID was required and this was not helpful. The Minister has just stated that people need PPS numbers, obtained through the Minister's Department, in order to access the scheme. A PPS number can only be issued by the Department of Employment Affairs and Social Protection, but it is very clear in the Data Protection Commissioner's findings and recommendations that people should not have to get PSCS solely for a purpose, including in the context of naturalisation, if that is the only reason they are asked to apply for PSCs.
It is a finding with which the Minister does not agree. I would question that the 3.2 million people who have the cards are all delighted and happy about it. While they already have the cards, it does not justify the retention of their data after the fact. If the Minister complied with the commissioner's third finding tomorrow, a person could still use his or her PSC, with the signature and the photograph, and could access all of the services available. Everybody would be satisfied, SAFE 2 would continue to get the services, and the Minister simply would not have the additional file on the person. In the Minister's survey - it involved 1,000 people and is, therefore, very small in the context of the 3.2 million cards issued - people were most dissatisfied with the retention of their records after the fact. This had the highest level of dissatisfaction.
On the fifth finding, which relates to privacy and the privacy statement, we are aware that the data protection officer in the Department changed the privacy statement to reflect biometrics being recognised as part of it. At the Oireachtas Committee of Public Accounts, the Data Protection Commissioner was clear that she is of the view that the Department collects biometric information. The Department's data protection officer, whose charge is the link between citizens and their data protection rights within the Department, was removed and replaced. Am I right that this-----
I will respond to Senator Higgins and Deputy Brady. There are 3.2 million active users of the PSC. We probably issued more than 4 million cards. Some may have been lost and therefore some have been issued twice. To say that people were made to get the card is the grossest misstatement that one could have made.
If the members had let me finish the statement, they might not have been prompted to shout at me. There are 3.2 million active users of the card. There are only 1.2 million recipients of services from within my Department. The other 2 million people who have the cards got them for the crack. They just got them because they wanted to have them in their back pocket. I put it to the members that the vast majority of people think this is a good idea. As I said earlier, most people the Deputy speaks to actually enjoy having the card and they use it for a variety of purposes and nobody is made to get a card. People are invited to go through the SAFE 2 authentication process, and more than 4 million times people have come into our offices and freely provided the information required to go through that identification process, and have done so. Are there people who are ideologically opposed to the card? Absolutely there are, but that is fine and is totally allowed. This is why we have alternative routes to access all public services, albeit they would not be able to do it online-----
-----and it may not be as quick and efficient as it would otherwise be. However, people are not being denied public services outside and above those provided by my Department in respect of which it is a requirement for individuals to undergo the SAFE 2 identification process because they do not have PSCs.
I have stated on a number of occasions that we do not agree with the findings. I am aware that the Senator and the Deputy very much agree with the findings, which puts them and me at odds. That is a pity. We do not agree with any of the eight findings initiated in the report that was presented to us on 15 August.
We shall conclude proceedings. I thank the Minister and her officials for attending. Whether members agree or disagree, the meeting has been informative. The one remaining issue is the further action from the Data Protection Commissioner. As this unfolds the Minister might keep this committee informed of proceedings. The committee will adjourn until Thursday, 5 December. The Select Committee will convene in 15 minutes to deal with Committee Stage of the Social Welfare Bill.