PSC data protection policy updated after Doherty loses seat
The Department of Employment Affairs and Social Protection has updated its key data protection policy with regard to the Public Services Card on foot of a negative report regarding the card carried out by the Data Protection Commissioner, Helen Dixon.
The move appears to be at odds with the Department’s own legal objection to the enforcement of that report’s findings, which is now subject to an appeal in the Circuit Court.
The change was made overnight on Monday in the wake of the Department’s Minister, Meath East TD Regina Doherty, losing her seat in the general election.
Ms Doherty had spoken out repeatedly against the DPC’s investigation into the PSC, justifying the Department’s appeal in the courts on the back of “incredibly strong” advice received from the Attorney General as to the legality of the PSC.
The updated privacy statement has been undertaken in order “to present information in an expanded set of headings and to provide additional information to address the deficiencies in the previous Privacy Statement as identified by the Data Protection Commissioner” according to an explanatory message on the Department’s website posted yesterday.
One interesting addition to the new statement is a specific recognition that the Department processes biometric data in the course of its business.
References to such data were dramatically removed from the previous privacy statement on the order of Secretary General, John McKeon, following the introduction of the EU’s General Data Protection Regulation (GDPR).
Under GDPR the processing of such biometric data — which sees people being made identifiable via their specific physical characteristics such as through the use of a photograph — requires a special legal basis, something which critics of the PSC project have insisted does not exist.
Previously, Minister Doherty had denied, repeatedly and at length, that such processing was taking place.
The new statement explicitly says that biometric processing of the photograph on the PSC is an example of “additional processing of personal data” carried out by the Department.
“This biometric processing of the photograph produces an arithmetic template which allows precise comparison of the photograph in question with others held by the Department,” the statement reads.
“This biometric processing is performed by the Department and the arithmetic template produced is not shared with any other specified body nor is it stored on the PSC.”
The Department says that such processing is justified under GDPR as it is necessary for the carrying out of rights under social protection law, on grounds of “substantial public interest”, and is required for “the provision and management of social care systems and services”.
The Department had not replied to queries from the Irish Examiner regarding the new privacy statement at the time of publication.
Meanwhile, the appeal regarding the DPC’s findings has now been delayed until March, it has emerged.
A second legal action taken by the Department against the DPC, under Judicial Review, has been delayed until later this month.
That action, which saw the Department object to the procedures which had seen the DPC declare the data accumulated as part of applications for child benefit to be unnecessary and disproportionate, had dragged on since before Christmas despite suggestions the Commissioner had been willing to drop her defence and withdraw her findings.
