THE GOVERNMENT COULD be set for a legal showdown with the Data Protection Commission as both sides refuse to move from their positions on the Public Services Card (PSC).

The commission, whose long-awaited report about the PSC was made public yesterday evening, has suggested it will issue an enforcement order against the government if it continues to process data in relation to the controversial card.

And the standoff could even see criminal proceedings initiated against the Minister for Employment Affairs and Social Protection, currently Regina Doherty, if the government continues to ignore the findings of the report.

The commission’s findings, first revealed last month, include a ruling that there is no legal basis for a person to be required to get a PSC for anything other than social welfare payments and benefits.

Data Protection Commissioner Helen Dixon also ordered the government to immediately stop processing the data of citizens for services outside of the department’s remit.

In a statement to TheJournal.ie, a spokesman for the commission also said it was preparing to issue a so-called enforcement notice to the department, which would order it to comply with data protection laws and to protect the rights of citizens.

But the Minister said last night that she was satisfied that the government’s processing of data for services aside from social welfare payments is legal, citing advice from Attorney General Séamus Woulfe.

In a statement accompanying the publication of the report, Doherty said:

While we respect the office of the DPC, in this instance based on strong legal advice, we cannot agree with the findings contained within this report.

We have strong legal advice that the existing social welfare legislation provides a robust legal basis for my Department to issue PSCs for use by a number of bodies across the public sector.

Criminal proceedings

Fred Logue, a solicitor who specialises in data protection law, explains that if the government continues to ignore orders from the Data Protection Commission, it would open the department up to legal proceedings.

“If an enforcement notice is issued by the Data Protection Commission, that’s an order for the department – as a data controller – to take steps to comply with the Data Protection Act,” he tells TheJournal.ie.

“And if they don’t take steps to comply with the Act, it’s a criminal offence, dealt with in the criminal courts.”

And because the department doesn’t have a separate legal identity, that outcome could mean that criminal proceedings are launched against the Minister, as head of the Department, herself.

According to the Data Protection Act, data controllers who are found guilty of failing to comply with enforcement notices face a fine – which Logue suggests could be up to €100,000 – or imprisonment of up to 12 months.

However, it is unlikely that Doherty would face a criminal trial, as the commission would likely seek to resolve the issue outside court through an amicable resolution instead.

Alternatively, the government could take a judicial review of a court’s decision if there is a finding against the Minister, meaning that a prosecution is unlikely.

Private setting

But Logue also points to another outcome of the commission’s report that could be problematic for the government: the ability for an individual to take a case against the department or other agencies based on its findings.

In its report, the commission noted how the department’s website indicates that the PSC will soon be required to make an appeal to the Department of Education in relation to the provision of access to school transport scheme, despite there being no legal basis for this.

It’s cases like this, Logue suggests, that could land the government in hot water.

“The outcome of the commission’s investigation is a legally binding finding,” he says.

“The report is a finding on the law, so whatever way you look at it, it’s something people can rely on if there are breaches of their rights under the Data Protection Act.

“There’s not even a requirement for commissioner to issue an enforcement notice; people can rely on the report to have its findings enforced in a private, civil setting if they want to.”

This outcome becomes more likely if the government continues processing data related to the PSC, as it has suggested it will, because it has already been told not to do so.

As well as school transport schemes, the PSC is already being used for other services outside the department’s remit, including passport applications “in certain circumstances” (such as first-time applications by those over 18) and Irish Naturalisation and Immigration Services.

For its part, the government has already said that it will appeal the findings of the report, although is is unclear on what basis it will do so.

Following the report of the publication last night, the department said it would not comment further, saying that to do so would be inappropriate given the possibility of impending court proceedings.