The findings of the Data Protection Commissioner’s report into the Public Services Card are a vindication for many parties.
A group of campaigners and legal experts has closely invigilated the progress of the project, tracking it closely as it spawned new functions, and often suffering the targeted ire of those in power for their efforts. The issue was also covered closely by a number of journalists.
It is also a major fillip for the DPC itself, which has for years pushed back against claims that it is a toothless regulator, too cosy with those it is supposed to be regulating. As the European regulator of tech giants like Facebook and Google, the DPC will have to win bigger battles on a global stage to fully disprove this thesis, but it has shown steel here.
Conversely, there will be a large cohort of civil servants and politicians licking their wounds this weekend. The PSC is a long-haul project. It was first mooted in 1998, and has been nursed along by generations of officials.
It is far from dead, but if the DPC ruling stands, its scope and its putative utility to the Civil Service will be a shadow of what was once imagined. In addition, its champions must now deal with their pet project being traduced as a sinister manifestation of a creeping surveillance state.
The State has been remarkably bullish in its defence of the PSC, and has roped various Ministers into the cause; Paschal Donohoe grinning next to an oversized PSC is not an image that will date well – nor Regina Doherty's "mandatory, not compulsory" line.
Sequence of crises
This is a government that has weathered multiple controversies – the national children’s hospital, the National Broadband Plan and CervicalCheck, as well as the rolling thunder of the housing and healthcare crises. The last thing it wants is yet another political scandal chipping away at public confidence. Not to mention that some Government TDs are feeling battle fatigue, and have concluded that the public lost enthusiasm for their governance a long time ago.
So, what next? The department and its Minister did a disappearing act on Friday, responding only in the briefest terms to the controversy. The DPC has put a firm timeline on the department’s response: it wants officials to stop processing personal data in relation to non-social welfare business within 21 days, and contact the bodies currently requiring production of the card to tell them they are no longer issuing PSCs for such purposes. Within six weeks, it must bring an implementation plan forward detailing how it plans to respond and what changes it plans to make.
There is a school of thought that views the silence from the department as ominous. Earlier this summer, there was a little-covered finding against the department by the DPC, in relation to child benefit. Rather than take it lying down, the department immediately sought to judicially review the decision. That may be an indication of how aggressively officials will defend their patch on this issue. There is an honestly held conviction in the department that the PSC is good public policy.
Questions put to the department on whether it was considering a challenge went unanswered on Friday. However, any challenge must be balanced against the increasingly toxic politics of the scheme; a government department in open rebellion against a regulator that the State has poured massive resources and political capital into in recent years is just bad PR.
Statutory basis
It would also be open to the Government to try and introduce legislation which would firm up the statutory basis for the card – however, in addition to the optics being poor on this as well, there is no chance of Fianna Fáil supporting such an effort, so the parliamentary sums don't add up.
There is a second salvo from the DPC in the offing. It is putting the finishing touches to another report on the card, specifically the biometric and photographic aspects. More adverse findings would fuel the controversy further.
There is also the question of immediate consequences for the department, and for other bodies who had insisted on the use of the card. The DPC said on Friday that fines aren’t possible arising from this investigation – it was conducted under different legislation to the powerful General Data Protection Regulation laws which allow it to levy penalties of up to €1 million on public sector bodies. But it remains an option to launch another investigation based on its findings, especially if it considers unlawful activity – such as the blanket retention of data – to have occurred after May 25th,2018, when the GDPR came into force.
Finally, there is a good chance legal cases will be taken against the department or another public sector body. At least one civil society group is actively considering such a step. The Public Services Card has its fair share of enemies, many of them in the legal profession. They are unlikely to be presented with a better chance to take a case. Their chances of success in a multiparty action are hard to determine, but the risk of being on the wrong end of a costly and embarrassing court defeat will concentrate minds in the public sector.
Undoubtedly, this saga has some way to run.