The State has been told it must delete data held on 3.2 million citizens, which was gathered as part of the roll-out of the Public Services Card, as there is no lawful basis for retaining it.
In a highly critical report on its investigation into the card, the Data Protection Commission found there was no legal reason to make individuals obtain the card in order to access State services such as renewing a driving licence or applying for a college grant.
While the card will still be sought from people accessing some services directly administered by the Department of Social Protection, such as claiming social welfare payments, the commission's report represents a major blow to the scope of the project, which has proved politically contentious and faced strong opposition from data-privacy campaigners.
Helen Dixon, the Data Protection Commissioner, told The Irish Times that forcing people to obtain such a card for services other than those provided by the department was "unlawful from a data-processing point of view".
It has directed that the department cease processing applications for cards needed for such functions.
Ms Dixon said there had been a “fundamental misunderstanding” of what was permitted by the legislation underpinning the card.
She said the department assumed that the legislation included a “legal basis for public sector bodies to mandatorily demand the card, and it doesn’t, once you conduct the legal analysis”.
“What we can see when we trace through it is that practice in implementation has now diverged from the legislation that underpins it,” she added.
Enforcement action
Ms Dixon found the retention of data gathered during the application process for the total of 3.2 million cards issued to date was unlawful.
“We’ve made significant findings around the data relating to the supporting documentation retained, and proposed to be retained indefinitely by the department,” she said. This documentation can include personal information on issues such as refugee status and changes to gender as well as people’s utility bills.
“There’s a whole range of documentation and the indefinite retention of it in circumstances where the Minister has satisfied herself as to identity already ... We believe there is no lawful basis for that.”
The department would face enforcement action, including potentially being taken to court by the commission, if it fails to act on the recommendations of the report.
The data would still be required during the application process, but must be destroyed after that, she said.
The commission also found that there was insufficient transparency around the card, and that the department had not made enough easily understood information available to the public.
Call for clarity
Ms Dixon also warned that the card, rather than simplifying application processes, in some instances would have created a requirement to prove identity that did not exist before.
She cited the example of appealing a decision made on the provision of school transport services, which needed no ID beforehand but was to require a Public Services Card in the future. “There may be a real artificiality in terms of embedding the requirement for the [card] in processes that heretofore did not require identification to that standard.”
Ms Dixon said it was “hard to imagine” that her report “won’t give rise to questions [about the card] on the part of the public”.
“The time is now to re-examine the lawful basis for what is happening, to re-clarify what the policy imperative is, and where this is intended to go.”
