THE Data Protection Commissioner (DPC) wrote repeatedly to the Mother and Baby Home Commission raising concerns about the handling of sensitive survivor testimony and delays in responding to queries.
The DPC also said they were “disappointed” that the Commission had not quickly responded to one of their letters and warned that failure to respond to their concerns could be a breach of their duty of cooperation under data regulations.
In response, the Mother and Baby Home Commission said they had been given insufficient time to deal with the queries and said issues were being “conflated” in the letters.
The DPC said answers to their concerns should have been “immediately to hand” and that the tight deadlines were necessary given the commission was going to be wound down at the end of February.
A letter said: “This of itself unfortunately raises issues about the Commission’s compliance with its GDPR obligations.”
The DPC also said it was noted that “a number of queries have regrettably not been responded to” and said lack of clarity on managing witness evidence was “due to a lack of information from the Commission”.
In the correspondence – which was released under FOI – the DPC raised a series of concerns over how redaction of records was being undertaken.
They also asked the Commission why they had not temporarily paused redaction of records as had been requested by the DPC.
In one letter, they raised queries over what the Commission had described as “personal Dictaphone recordings”.
“Do you mean that the notetaker had their own Dictaphone (or similar recording device) provided to them by the Commission, or that they recorded witness testimony using their personal mobile phone or other personal device that was not in the control of the Commission?” said the correspondence.
Among other concerns raised were a standardised letter to witnesses who had requested redactions to the evidence they had given.
They wrote: “That letter does not provide the witness with any details of the records which are within the scope of a redaction request and does not provide them with access to those records.”
The DPC said it was their understanding that some witnesses would need to see the records to understand what had been written down in evidence.
They also said while legislation covering the commission appeared “purports” to restrict people’s rights under the GDPR personal data regulations, this could not be done in a “blanket fashion”.
Their letter said: “It is also important to note that redaction and/or erasure of personal data is an act of processing that is regulated by the GDPR, and which therefore must be carried out in compliance with the GDPR.”
The DPC also sought clarity on how witness testimonies were recorded and where they were stored, in the correspondence from January.
It asked about copies of electronic recordings, and said they wanted to know what would have been the “lawful basis” for any destruction that took place.
The DPC also warned of the possibility of information relating to the children of mothers at the homes being permanently and irrevocably lost.
It asked for a list of rules and guidelines that were being used for management of that data, and for all the redactions the commission planned to make.
The DPC also raised concerns about transferring the Mother and Baby Home archive to the Minister for Children and how that was being managed.
It said “time [was] of the essence” in getting answers to their queries as the Commission was to be wound up by law at the end of February.
In another letter to Minister Roderic O’Gorman, Commissioner for Data Protection Helen Dixon reiterated those concerns, saying it was “urgent in light of the Commission’s forthcoming dissolution”.
She said a whole range of matters remained “unclear” and that they had asked the Mother and Baby Home Commission to suspend its redaction process pending clarification.
Dixon wrote: “I should also note that my office has started to receive complaints from data subjects relating to the Commission’s data processing and its approach to data subjects’ rights.”
In a statement, the Department of Children said at the time of the correspondence, the Mother and Baby Home Commission was the data controller for the records.
However, they now fulfil that role. They said: “[Our] officials have engaged regularly in recent months with the Office of the Data Protection Commissioner to continue to share updates on progress being made by the Department and to discuss some of the more complex matters concerning the archive.”
To embed this post, copy the code below on your site
have your say