THE DEPARTMENT OF Children is failing to apply General Data Protection Regulation (GDPR) correctly as Mother and Baby Home survivors attempt to access personal information, a data compliance expert has said.
In one instance, the Department of Children, Equality, Disability, Integration and Youth (DCEDIY) refused to share information with a woman because it relates to a person who is deceased.
Solicitor Simon McGarr said that such a stance is at odds with GDPR as dead people “do not have any GDPR rights”.
Speaking to The Journal, McGarr said: “It’s simply not accurate in law to say that if data relates to a person who has died that somehow takes it out of the scope of the GDPR because GDPR rights don’t attach to data, they attach to people.
“The only person who’s affected in terms of their GDPR rights when someone has died is the person who has died. The dead do not have any GDPR rights.”
McGarr plans to lodge a complaint with the Data Protection Commissioner (DPC) if the relevant information is not sent to his client by the end of the week.
He said legal proceedings would be issued directly against Minister Roderic O’Gorman “if needs be”.
Under Article 15 of GDPR, people have a right to submit Subject Access Requests (SARs) if they wish to be given a copy of any of their personal information which is being processed by controllers (in this case, the department).
The DCEDIY became the data controller for records held by the Commission of Investigation into Mother and Baby Homes after the Commission dissolved at the end of February.
The refusal letter sent to McGarr’s client, who submitted an SAR to the department, states: “A decision has been taken to refuse your request as GDPR does not apply to the personal data of deceased persons. Access requests seeking the personal data of deceased persons cannot therefore be processed by the Department.”
It’s understood that other people who submitted SARs have been refused access to records for the same reason.
‘Perhaps the most wrongheaded basis’
In a letter sent to the DCEDIY on Tuesday, McGarr stated: “We write to inform you that the Minister and the Department have misadvised themselves as to the applicable law. The refusal you have supplied would only have legal merit in the event that the SAR was made by a deceased person.
“It is, perhaps, the most wrongheaded basis for a SAR refusal which we have encountered in the circumstances of our client’s request. This data remains the personal data of our client. Our client remains amongst the living.
“The GDPR therefore continues to apply to her, and her Article 15 rights continue to oblige the Minister to comply with his duty to provide her with a copy of same within the statutory period.”
In recent months survivors have made numerous complaints about the speed and manner in which the department is handling their SARs.
McGarr said he and others who have sought information are “encountering an extremely high level of obstruction”. He has made three related complaints to the DPC in recent weeks.
When asked by The Journal about the issues raised by McGarr, a spokesperson said the department “is not in a position to comment publicly on access requests made by individuals”.
“Individual requesters can of course revert to the Department directly to seek further information on the response they have received. They can also make a complaint to the Data Protection Commissioner. In general, the Department seeks to provide some clarification regarding what data can be released.”
The spokesperson noted that Article 15 of GDPR “provides that a data subject shall have the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data”.
A statement added: “The Department is responding to subject access requests in full accordance with GDPR. Members of the public sometimes request data belonging to deceased family members. Where this is mixed personal data, in that it refers to both the requestor and the deceased person, the Department can release this data.
“Where the data is not mixed personal data and belongs solely to another deceased person, the Department will not be able to release it under GDPR and the requestor may be advised to use Freedom of Information Act instead.”
McGarr said there are “far more reasons for refusal” of FOI requests, which operate under “a completely different legal framework” to SARs. An FOI request, unlike an SAR, “doesn’t have the force of EU law behind it”, he added.
Comments are closed for legal reasons.
To embed this post, copy the code below on your site
have your say