Dáil Éireann Debate, Wednesday - 4 October 2023
226. Deputy Neasa Hourigan asked the Minister for Health if any investigations will be considered in light of findings from the Data Protection Commissioner that officials in his Department kept dossiers in a manner that was unlawful and unnecessary, containing sensitive information on families of children with autism who had previously engaged in litigation with the HSE; and if he will make a statement on the matter. [43122/23]
View answerI thank the Deputy for their question. My Department cooperated fully with the Data Protection Commissioner during the course of their investigation into the allegations raised on RTE’s Prime Time programme. The Department at the time of the original programme in 2021 and in light of the recent programme, once more rejects the characterisation that it kept secret dossiers on children.
The Department was maintaining documentation for the purposes of managing ongoing legal cases. The DPC did not find an infringement of data protection law arising from the fact that the Department stored this information for the purposes of defending litigation.
The DPC investigation was only concerned with the manner in which the Department collected and processed personal data of members of the public who had historically taken litigation against the Department.
The Department of Health fully accepts the Data Protection Commission’s decision following their investigation and has accepted the corrective measures imposed by the DPC.
A report carried out into the matters by Senior Counsel found no evidence that the Department of Health was secretly compiling dossiers on children with autism involved in SEN litigation.
Parties to a legal case have lawful obligations to retain all potentially relevant documentation whether or not discovery has been agreed or ordered.
The DPC recognised that there are a number of obligations that require defendants to retain documents that relate to open litigation.
Parties’ respective obligations and entitlements are not diluted by the fact that the proceedings are dormant for a period of time. Dormant cases are not resolved or dismissed. They remain “live” proceedings, pending before the Courts.
The DPC did not find evidence on the 29 litigation files examined that the Department had proactively sought information from other government departments or co-defendants other than the HSE.
Sensitive personal data was historically, nonetheless, submitted to the Department of Health by other parties (such as the video referred to in the report which was submitted as an exhibit to an affidavit by the plaintiff’s representative).
The Department has acknowledged that historically, there were issues around the proper retention and data minimisation, transparency and security controls in Department of Health. These issues were highlighted by the DPC in the course of their investigation and the Department have taken the appropriate steps to resolve these issues.
In response to the DPC Decision, the Department accepts the position that, although the information it gathered and processed was in line with legal advice received previously, the application of GDPR meant the department could no longer rely upon those same legal bases for the gathering and storing information.
The Department accepts that under both European Union and Irish data protection legislation it was not proportionate nor necessary to retain such personal data.
The Department of Health is committed to protecting the rights and privacy of individuals in accordance with both European Union and Irish data protection legislation. The Department takes its responsibilities in relation to data protection very seriously.
