Joan Burton (Dublin West, Labour) | Oireachtas source

There is a protocol, as well as regular information and training programmes, in the Department in respect of people's personal data not being utilised in any way that falls outside the law and the Department's regulations. In addition, the Data Protection Commissioner closely oversees the Department's work in that respect, as the commissioner's primary function is to protect people's data. I am glad to report that, in this case, the commissioner was zealous in doing so.

If the person making the call claims to be the subject of the data request, he or she is first asked for identifying details such as his or her PPS number, which the people in question had, date of birth, mother's maiden name and other personal information that would help to verify that the person making the inquiry is who he or she is claiming to be. Since the people in this case already seemed to have an amount of data about the individual, they were able to answer the standard queries. If there is any doubt, people are asked to telephone back or further inquiries are made about the caller's identity or authority to ring on behalf of the particular customer. For example, public representatives make contact with the Department. It must be established that they are public representatives and that they have people's permission to approach the Department on their behalf regarding queries.

See this speech in context