INSTEAD OF CONCEDING ground, the government is doubling down on the Public Services Card (PSC).
Yesterday, Minister Regina Doherty took to national radio to say that the government would be challenging the findings of the landmark inquiry into the legality of the card in court.
Furthermore, she signalled the government would be defying the direction from the Data Protection Commissioner and continue to retain the data of people who apply for the PSC.
“My legal advice is incredibly strong,” Doherty told RTÉ Radio One’s Morning Ireland, adding that this advice says there is a “clear and unambiguous legal basis” to continue operating the card as has been done up to now.
“We believe that we do have legal rights and legislation to underpin exactly what was anticipated,” she said.
What has prompted the government to take this course of action? And what can we expect from a court battle?
The Data Protection Commissioner Helen Dixon began her investigation into the legality of the PSC in October 2017, after months of controversy over the card.
The spotlight was put firmly on the Public Services Card back in August 2017, when the Irish Times reported that a woman had her pension cut because she refused to get a card.
Over the past three years, TheJournal.ie has also highlighted other cases such as when a woman was asked for an adoption cert when applying for a PSC; another where a woman was asked how long she’d been living with her partner when applying for one; and people even being denied one because they were adopted.
Dixon gave the Department of Employment Affairs and Social Protection a draft of this report in August 2018. She told TheJournal.ie last month that the main findings in this draft aren’t significantly different from the main findings in the finished report.
In any case, the department sent back its response to the draft in November 2018 addressing what was in the report.
Finally, then, in August 2019 the report was finalised and sent to the department.
Dixon made three main findings:
Also included in these findings was a direction to the department for a progress report within 21 days (ie this Friday) on the removal of the PSC as a requirement for non-welfare related services and an implementation plan for the second finding on the retention of documents within six weeks.
Although it took several weeks to respond, the government has signalled this week that it will be challenging these findings.
In a joint statement from the Department of Public Expenditure and Reform and the Department of Employment Affairs and Social Protection, it said:
Following very careful consideration of the report and having taken the advice of the Attorney General’s Office, the ministers informed government that they are satisfied that the processing of personal data related to the PSC does in fact have a strong legal basis, the retention of data is lawful and that the information provided to users does satisfy the requirements of transparency.
On this basis the Ministers believe that it would be inappropriate, and potentially unlawful, to withdraw or modify the use of the PSC or the data processes that underpin it as has been requested by the DPC.
In other words, the government is saying it believes its processes have a strong legal underpinning, and will fight it in court if necessary.
There are several bits of legislation and directives underpinning data regulation in Ireland, but the statutory powers and duties of the Data Protection Commissioner are underpinned by the Data Protection Act 2018, relating to GDPR. Dixon’s powers are also underpinned by previous legislation.
Solicitor Fred Logue told TheJournal.ie when the findings were published that it’s “not entirely clear [...] how enforceable it is”.
Though the Data Protection Commissioner outlined to the government a timeline for when she wants its recommendations actioned, the government has now said it will continue on as it has been, given its own legal advice.
If the government is unwilling to comply with the directions of the Data Protection Commissioner, the latter can seek an enforcement order in the courts.
When it came to this report, there was no explicit power for the Data Protection Commissioner to publish the report, and the government is within its rights to appeal the findings.
Solicitor Simon McGarr also told TheJournal.ie that it was entirely possible that the government could seek some sort of legal action to appeal the findings, such as a judicial review.
However, the government has said this week “that it may be necessary and appropriate for the matter to be referred to the courts for a definitive decision”. This doesn’t necessarily mean they will directly appeal the findings themselves.
It could take the form of the government challenging the Data Protection Commissioner in court when defending why they haven’t acted on the findings.
As stated, the reason given by government is that it’s confident in its own legal advice. Furthermore, it’s been extolling the virtues of the PSC project – which has cost over €60 million to date – for some time now.
“We think the Public Services Card is the best way of making sure that the billions of euro that we spend in providing public services are made available to the people that need them,” Minister Paschal Donohoe told RTÉ’s Today with Sean O’Rourke when, in the summer of 2017, controversy was beginning to build.
Taoiseach Leo Varadkar previously said it’s something “that is actually of real benefit to citizens”. He echoed these sentiments last month, saying that while the legality of the PSC will have to be examined, “it’s still a good project notwithstanding the difficulties that have arisen”.
And, according to McGarr, the findings from the Data Protection Commissioner open up the government to future litigation.
“Under the GDPR, there’s an explicit right to take action and seek compensation for material and non-material loss,” he said.
“If your rights have been breached, you’ve a right to claim. The size of the claims could be small. We don’t know.”
Citing two precedent cases in Ireland and England, where the payout was roughly €15,000 in each instance, McGarr said that any number multiplied by the 3.2 million citizens who’ve received a PSC would be a “very large number”.
“The illegality [found by the Data Protection Commissioner] involved privacy and data protection rights of a very large proportion of the country,” he said.
The government not implementing the findings of the report and defending itself in court – while potentially a costly and lengthy process – could save it more in the long-term if the court rules in its favour, ruling out even costlier litigation.
By refusing to adhere to the findings and saying it would challenge them in court, a bullish government is aiming to press on with its PSC project rather than scaling it back despite the slap-down from the Data Protection Commissioner.
And, after a two-year investigation in which it is confident in its findings and giving the department strict deadlines to take action, it’s understood the Data Protection Commissioner would contest any legal action swiftly and in the strongest possible terms.
With the initial 21-day deadline this Friday, any action could take place very soon.
According to Regina Doherty, the next step is for her to meet with Data Protection Commissioner Helen Dixon to discuss the findings of the report.
After this meeting, if indeed it does take place at all, Doherty has indicated she will publish the report.
“I absolutely intend to publish the Commission’s report and our response to it,” she said.
The government has been under pressure to publish the report in full. In telling TheJournal.ie the findings of the report, Dixon said she felt it was in the public interest to do so, and this has been echoed by opposition TDs and activist groups.
In a statement to TheJournal.ie yesterday, Data Protection Commission head of communications Graham Doyle said: “I can confirm that we received correspondence from the Department of Employment Affairs and Social Protection [on Tuesday night]. We will be responding to the Department by the end of this week.
In relation to the issue around the publication of the report, the DPC believes that the report should be published immediately in the public interest.
The opposition, meanwhile, has also criticised the government for the way it’s conducted itself so far.
Sinn Féin TD John Brady said yesterday: “Minister Doherty has shown utter contempt for the office of the Data Protection Commissioner whose primary role is to uphold the fundamental right of individuals to have their personal data protected.”
Concerns have also been raised that challenging the ruling at all could be reputationally damaging for Ireland.
Liam Herrick, of the Irish Council for Civil Liberties, said this week: “Ireland has a very important international reputation as a centre of technology, and indeed of data protection.
We have to comply with the rule of law. We have to comply with the regulatory bodies [and] respect the independence of those bodies that we established. And if we don’t do so, the financial consequences and the reputation consequences might be much greater than the short-term damage by administrative project that’s gone wrong.
All eyes will now be on the report if and when published to see how damning it actually is for the government ahead of any legal challenge, with the government showing no signs of backing down on the PSC any time soon.
To embed this post, copy the code below on your site
have your say