Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

51. To ask the Minister for Employment Affairs and Social Protection if the final report on the Data Protection Commissioner's investigation into the public services card will be published; if a full or summary report will be published; the reason a full report would not be published; and if she will make a statement on the matter. [8093/19]

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

There are many regulators in Ireland, most of which, including, for example, GSOC, the Competition and Consumer Protection Commission and the Food Safety Authority of Ireland, provide clear pathways to track enforcements on imports. The Data Protection Commission appears to have looked at a wide range of issues in one form or another, yet there is no clear record of reports or enforcement actions that is easily accessible. If the commission will not publish the full and final report on the investigation into the public services card, will the Minister commit to doing so, irrespective of the outcome of the investigation?

Regina Doherty (Meath East, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I am going to tell the Deputy how to suck eggs-----

Pat Gallagher (Donegal, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

Go on; the clock is ticking.

Regina Doherty (Meath East, Fine Gael)
Link to this: Individually | In context | Oireachtas source

-----when I tell him that the purpose of the SAFE 2 registration process is to verify someone's identity to a substantial level of assurance. This is a necessary step when we are responsibly providing access to the billions of euro, of which the Department of Employment Affairs and Social Protection is in charge and which it is giving to people through all of its schemes. The public services card is only issued after someone goes through the SAFE 2 registration process. In addition to acting as a token that an individual's identity has been verified to SAFE 2 standard, possession of a public services card enables individuals to gain access to a great many other public services, for example, free travel, more efficiently and with a minimum of duplication of effort, while at the same time preserving their privacy to the maximum extend possible.

Preliminary results of a recent customer survey carried out on the public services card have been quite positive, with very high levels of satisfaction recorded in the process of applying, the resulting public services card, people's level of understanding of the purpose of the SAFE 2 and PSC process and the information provided for applicants. These are all being very well received. People also expressed strong support for the sharing of information between public bodies because it makes life easier, which is exactly what we were trying to achieve in the first instance. I hope to have the full results of the survey next week and that all Deputies will join me in welcoming these positive results.

To respond to the question the Deputy asked me, the Data Protection Commissioner initiated an investigation to assess the legal basis for the processing of data in connection with the public services card and other related matters in 2017. The Data Protection Commissioner provided a draft report on the public services card for my Department in late August 2018. The draft report requested further information and clarification from us in a broad range of areas, but - it is a big but - the commissioner specifically instructed us not to discuss or disclose the draft report to any other party. We will respect that request. Therefore, I cannot give the Deputy an indication that I will publish the report, but I genuinely have no doubt but that when the commissioner replies to us, they will publish the report. If they do not, the only thing I can suggest is I seek permission at that stage, if appropriate, to do so. However, I am not in a position to give the Deputy an assurance that the draft report will be issued because my Department has been instructed specifically that we are not to discuss or disclose it. I must do what I am told.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

In the interests of transparency, we hope that when the report is eventually made available, the Minister will publish it. Transparency certainly helps. It is amazing that the Department's response to the Data Protection Commissioner's inquiry, at this late stage in the history of the public services card's roll-out, requires such a protracted, extended defence. This is the largest data-sharing project in the history of the State and I think it has cost approximately €60 million so far. The Minister has not halted the roll-out of the public services card, pending the outcome of the investigation, and her Department has had to write the equivalent of a PhD thesis to defend itself after the horse has well and truly bolted. However, listening to what she is saying, it looks like the public will not get a good look at the terms of the commissioner's investigation. The Minister argues about the merits of the public services card. We are not arguing against them, but we are arguing on the issue of consent. If people consent, that is grand. Yes, the public services card involves efficiency, but one cannot force people to consent to using it. That is our argument.

Regina Doherty (Meath East, Fine Gael)
Link to this: Individually | In context | Oireachtas source

To answer the Deputy's two questions, we received the report from the Data Protection Commissioner in August. We provided a comprehensive response for the office on 30 November and have been awaiting its response since. As I said to the Deputy, publication of the report is now entirely a matter for the Office of the Data Protection Commissioner, given that it has given us clear instructions that we are not to discuss or disclose the draft report. I would have the legs cut off me were I not to do what I have been asked to do by it, particularly in the light of the investigation and the sensitivity attached to it.

I refer the Deputy to what he has just said. We do not make anyone get a public services card. If people do not want to get it and do not want to go through the SAFE 2 process, they do not have to do so. However, 3.2 million people have gone through it and the results of the satisfaction survey have given us incredibly positive responses. As the Deputy rightly says, perhaps the Data Protection Commissioner will come back with a different response. Whatever it is, either the Deputy or I will have to accept the outcome, depending on whatever point of view we share or do not share with the Data Protection Commissioner at the time.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

The Minister is saying the card is optional. Have payments been withheld from anyone who does not have it?

Regina Doherty (Meath East, Fine Gael)
Link to this: Individually | In context | Oireachtas source

No.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

Absolutely not.

Regina Doherty (Meath East, Fine Gael)
Link to this: Individually | In context | Oireachtas source

No.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

From our point of view, one of the main problems with the public services card is that the aim of it and the SAFE 2 registration process is not limited to verification. As I said, it is also to coerce consent to data-sharing. Perhaps the Minister is now denying it, but section 262(6) of the Social Welfare Consolidation Act states:

(a) Where a specified body has a transaction with a person, the Minister may share the person's public service identity with the specified body to the extent necessary for authentication by the specified body of the person's public service identity.

(b) A specified body may use a person's public service identity in performing its public functions.

The word "may" is significant. Yes, it permits data-sharing, but it does not require or demand it. Data-sharing is not an inevitable consequence of the verification of a person's identity. Section 247C(1) also makes it clear that the purpose of the verification process is "to satisfy the Minister as to his or her identity". Once the person's identity has been verified and once the Minister is satisfied as to the person's identity, there should not be any legal basis for further processing of the person's data, unless his or her consent has been obtained. Is our interpretation wrong?

Regina Doherty (Meath East, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I do not know. What I do know is that we do not make anybody undergo the SAFE 2 authentification process. With the exception of one lady, for whom the issue was resolved soon after I came into the Department, we have never withheld a payment due to somebody not having gone through the SAFE 2 authentification process. That is not the purpose of it. It is not a control measure in the way the Deputy describes and it is certainly not coercive. There are 3.2 million people in the country who have public services cards as a result of having undergone the SAFE 2 process, yet none of them has broken legs. We did not coerce anybody and nobody is being made to do anything.

We have responded to the concerns that were raised with us by the Data Protection Commission last August. We replied in November and we await its response. I cannot tell the Deputy what the outcome will be because I will not know until the commission reverts to me.