Today’s Sunday Times (um, [insert link to print paper]) reports that the DPC’s #PSC investigation report has found @welfare_ie’s claimed legislative power
“does not provide a sound legal basis to compel people to have a card to access other public services”
As the state cannot rely on consent (as any consent could not meet the requirement for being freely given, given the power imbalance), this- if it stands- would mean that all of the processing done without another legal basis would be in breach.
I gave evidence to the Joint Oireachtas Committee on Social Protection on 8th February this year, trying to warn of this self inflicted crisis.
It should be remembered that using the #PSC as a ID card and requiring it to access other public services, was not a @welfare_ie project but the brainchild of the Dept of Public Expenditure & Reform @IRLDeptPER
The state has attempted to present the #PSC card as both something voluntary but also legislatively required.
This gave it not one, but two legal grounds for processing.
Hence “Mandatory but not compulsory” as the Minister pithily put it.
In reality Gov had no legal basis for requiring the #PSC card statewide.
As the DPC’s draft report (quoted above) finds, it never had a legislative basis.
And its fallback position- that the processing is by consent of the user, is invalid because the consent has been compelled
Here’s what the Article 29 Working Group (the collective of Data Protection Regulators) has to say about public authorities trying to rely on consent (after GDPR) as a legal basis for processing data:
You can read that #PSC illegality report story online at the @SunTimesIreland now
Here I am on Morning Ireland, explaining why the @welfare_ie demands that people get a Public Services Card (and that card data is shared across the State) doesn’t have a lawful basis (and certainly not the one they told the DPC) #PSC cdn.rasset.ie/manifest/audio…
Here was the roadmap published for all the other Government services which (without a lawful basis) would be made available only to people with #PSC cards
The Department has some few weeks to respond to the DPC report before it’s published.
I think a copy of the report should also be provided to the organisations and individuals whose #PSC complaints were met by a reassurance that the matter was under investigation already.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Thought I’d give you a quick round up of where we are with the Public Services Card scheme. Because these things go in months or years long arcs, it can be helpful to take stock. #PSC
The #PSC project sees the Dept of Social Protection (DEASP) acting as joint Data Controller with the Department of Public Expenditure and Reform (DPER) over a database of citizen’s identity, called the Single Customer View.
The PSC is the card attached to that database.
At some point in the past, DPER decided it wanted a single ID card and database which would be used throughout the public service to gain access to services- and they preferred to call it a “Public Services Card”, instead of, you know, an ID Card.
I have blocked the Senator, previously. But this statement- attempting to defend a Bishop’s earlier statement by asserting not all unwanted sex is rape- is sufficiently telling to be worth spreading, as an example of why registering to vote is worthwhile.
This was the Bishop’s contribution to public discourse.
Bishops gonna bishop. But as an NUI Senator, Senator Mullen is taken to represent me (an NUI grad). I’d prefer it it were otherwise.
Neither the Minister for Employment and Social Protection, nor- it seems- the Secretary General of the Department appear to know what Biometric Data is.
This is concerning as the Dept is the largest processor of biometric data in the State, thanks to the #PSC card database.
What we can infer is that the Depts new Data Protection Officer (whoever she or he is) *does* know the definition of Biometric Data and so they put it in the Privacy Notice that they were processing it.
(That’s a thing you have to do now, per GDPR)
We know the Minister has asserted that the Dept of Employment and Social Protection doesn’t collect biometric data. At all. (Small video of just the most recent of those statements)
The Government has just lost on an amendment in Seanad proposed by @aliceeire to Data Protection Bill. They've called for a walk through vote. The amendment would limit the powers of Ministers to act, by ensuring doing so would only be where it was necessary and proportionate
Nope, reversed after a whip around of extra senators by the Gov side, and with the casting vote of the Chair.
Today, on and off, I have been reading the newly published Data Protection Bill, which is 132 pages long, being introduced via the Seanad, and needs amendments submitted by next Tuesday.
Unfortunately you can’t table an amendment that says “this is terrible”.
It is the worst.
I’m going to have to blog it over the weekend.
I think Section 54(3) a list of made up exemptions for the state not in the EU law that the State wishes had been in the Regulation *might* be the worst.
But then I think: What about Section 56(6) where the state wants to pretend it can exempt itself, or anyone, from anything it thinks is in the public good?
This is quite significant. Irish Water relied on their Schedule 5 status to collect PPS Numbers. (the same basis @welfare_ie used to justify DPER Processing data on their behalf.)
Then they had to destroy all those records when they couldn’t produce a Ministerial Agreement.
The 2014 Agreement starts off as an Agreement between Ministers (as you might expect).