A ‘public services card’ in Ireland designed to help citizens access services, receive welfare payments and crack down on fraud has been heavily criticised by the country’s data protection authority.
Ireland’s Public Services Card (PSC) – which has been issued to 3.2 million citizens – holds the user’s name, photograph, signature and ‘Personal Public Service’ (PPS) number. The card was introduced eight years ago, initially just for claiming welfare payments. But the PSC has increasingly been required to receive other public services, such as obtaining a driver’s licence.
In a report sent to Ireland’s Department of Employment Affairs and Social Protection last week, the country’s Data Protection Commission (DPC) found – after a “detailed and lengthy investigation” – that there was no legal reason to make individuals obtain the card to access state services and that it was unlawful for the state to retain data gathered as part of the card’s introduction.
The PSC, and the system of registration behind it, involves the collection, storing and processing of large amounts of personal information about nearly every person in the state, the DPC said. Eight findings are made in its report: three relate to the legal basis issue; the remaining five relate to issues around transparency.
The Dublin-headquartered DPC said: “Ultimately, we were struck by the extent to which the scheme, as implemented in practice, is far-removed from its original concept. Whereas the scheme was conceived as one that would make it easier to access (and deliver) public services, with chip-and-pin type cards being used for actual card-based transactions, the true position is that no public sector body has invested in the technology capable of reading the chip that contains the encrypted elements of the Public Sector Identity dataset. Instead, the card has been reduced to a limited form of photo-ID, for which alternative uses have then had to be found.”
Government response
The Government has said it plans to respond “as quickly as possible”.
Speaking last weekend, the country’s Taoiseach, Leo Varadkar, was quoted in the Irish Times as saying: “There will need to be some changes around the retention of data, transparency and strengthening the legal basis of the Public Services Card.”
One of the issues the Government will address is deleting the retained data on cardholders, Varadkar added.
The Department of Social Protection will still be able to request the card from those collecting welfare payments, but other state bodies will not be able to demand that people possess one.
The DPC report’s findings into the card have been described in the Irish Times as a vindication for many parties, including the DPC itself, campaigners and legal experts concerned about the potential impact of a data breach.
Irish Times journalist Jack Horgan-Jones wrote that if the DPC ruling stands, “its scope and its putative utility to the civil service will be a shadow of what was once imagined. In addition, its champions must now deal with their pet project being traduced as a sinister manifestation of a creeping surveillance state.”
Digital Rights Ireland (DRI), a privacy advocacy group, has long been campaigning on the PSC. On 23 July the group tweeted: “Many public bodies can’t even make up their mind if they require the PSC or not, or may not even know that they do”; on 16 August, the day the DPC published its report, DRI tweeted: “The #PSC was used as a tool to bully and control. We came across a woman who had worked all her life, then had her pension cut off indefinitely because she refused to get the PSC. Others were refused passports and driving licences, with no legal reason.”
Media reports say that the Irish state could face legal action, with civil society groups saying they are considering class action-style cases.
The Public Accounts Committee on 19 August reportedly confirmed plans to carry out an investigation into the spending of more than €60m on the scheme.
The DPC has given a six-week deadline for the government to detail how it plans to respond. The authority is also working on a separate investigation into the photographic and biometric aspects of the card.
