The Government “will be required to comply” with an order to delete data on the 3.2m people who hold public services cards, data protection commissioner Helen Dixon has told an Oireachtas committee.
The Department of Employment Affairs and Social Protection has rejected the commission’s findings that it has no legal basis for keeping mass electronic records of cardholders or permitting those cards to be used by other Government departments as a de-facto national ID.
Ms Dixon told the Public Accounts Committee that her office would serve an enforcement order “imminently” on the department - and foresees eventual victory following a potentially protracted and costly legal fight.
“Once an enforcement notice issues, the department will have 21 days to comply or appeal,” she said, noting that the latter course could mean legal arguments in a succession of venues starting at Circuit Court level.
“We are confident in our findings, we’re confident in the investigation that was fairly conducted by the office, we’re confident in terms of our analysis, and we stand over it,” she said. “I would imagine the ultimate consequences are that they will be required to comply.”
Ms Dixon said the Government’s response to her findings had been inconsistent, with the Department of Foreign Affairs and the Department of Transport both ending their practice of requiring the cards for passport and driving licence applications, respectively.
But she said other departments still were using or planning to use the card in ways that were “outside the law”. She highlighted Government plans to require the card from applicants for a new childcare scheme.
“The Department of Children and Youth Affairs appears to be pressing ahead with a requirement for the new childcare scheme that individuals use a public services card to apply online,” she said.
“And the only alternative option that appears to be offered is a manual paper-based application that won’t be ready until the new year and won’t provide back payments. So clearly this is completely at odds with the findings of our report and the directions that we’ve issued.”
Ms Dixon also disputed claims by Minister for Employment Affairs and Social Protection Regina Doherty that she twice had refused to meet the Minister or her senior officials following the data commission’s mid-August delivery of the report.
The data commissioner said she had responded positively to an initial August 22 email from the department’s deputy secretary general seeking a meeting to discuss the report contents. But she heard nothing more until September 3 – immediately after Minister Doherty had given a series of media statements rejecting the report.
Ms Dixon said the Minister’s remarks had made it clear that her department “did not intend to comply with any of the recommendations”, while the September 3 message from the department’s secretary general had requested a meeting that explicitly sought to “negate the requirement for any enforcement proceedings”.
“This was entirely inappropriate,” Ms Dixon said of the September 3 request.
She told the PAC committee that her commission’s €15.3m budget this year includes €8.9m for payroll and €6.4m million for operations, chiefly legal costs. Its staff has grown by 25pc over the past year to 138.
Nonetheless, Ms Dixon said her office remains smaller in staff size and budget than the data protection offices of seven other EU nations, including the UK’s 513 staff and €51m 2018 budget and France’s 199 staff and €17m budget. She said her office needs better accommodation urgently and a nearly €6m increase in funding next year.