Dáil Éireann debate -
Wednesday, 25 Sep 2019

Vol. 986 No. 5

Public Services Card: Statements

Minister for Employment Affairs and Social Protection (Deputy Regina Doherty)

It will be useful to outline the history, rationale and legal basis of the public services card, PSC. It was provided for in legislation in 1998, when it was introduced alongside the personal public service number, PPSN, to replace what were previously the revenue and social insurance, RSI, number and the social services card, SSC. The clear and stated objective, as articulated in the Oireachtas at the time, was that the PSC was not to be confined to welfare services but that the PSC and the PPSN were to be used widely throughout the public services to assist people in their dealings with public sector organisations. Successive Governments have reaffirmed the policy, both in Government decisions and through legislation. At each stage, Ministers were always clear as to the purpose of the legislation. Various Members welcomed the development of the PSC and on occasion inquired as to why its functionality and role were not extended further.

The PSC is now used by a number of specified bodies as a means of authenticating identity. The Comptroller and Auditor General acknowledged the Department's position that the main benefit of the PSC was in saving time previously spent re-verifying identity when a member of the public accesses a public service. Although some critics have described the PSC as a national identity card, it is not, given that nobody is required to carry it at all times, nor to produce the card at the request of any civil authority such as An Garda Síochána. In fact, such a request would be illegal.

On 27 October 2017, the Data Protection Commission, DPC, initiated an investigation into the Department's compliance with its responsibilities as a data controller in respect of the PSC's related matters, including the legal basis for the processing of personal data and compliance with EU law. The Department co-operated fully with the investigation, including through the provision of detailed responses to a draft report provided to the Department. The final report, relating to the legal basis and transparency issues, and containing eight findings, was received by the Department on 15 August 2019.

My Department, together with the Department of Public Expenditure and Reform, has carefully considered the report and the letter received from the DPC, and sought the advice of the Office of the Attorney General. It is clear to us, based on the advice received, that the processing of personal data relating the PSC complies with legal requirements, that the document retention is lawful and that the information provided satisfies the transparency requirements. The Department sought to meet the DPC on two occasions since the receipt of the report, with a view to outlining the basis for its conclusions and seeking to clarify a number of matters. The request for a meeting was declined on both occasions.

Given the strong legal advice received, the convenience offered by the PSC to users and organisations that rely on its use, and the high levels of public satisfaction with the PSC, it is considered it would be inappropriate to withdraw or modify its use in the manner requested by the DPC. The DPC has been notified of the decision and has indicated that it intends to initiate enforcement proceedings. When an enforcement notice is received, I, together with my officials, will give it careful consideration but at present, my legal advice indicates that the only option available to me is to appeal an enforcement notice, should it be received.

I fully recognise and respect the role the DPC plays in our society. The issues in question relate primarily to correct interpretations of social welfare legislation. As practice has borne out, it is not unusual for bodies to have divergent views on correct interpretations of legislation. When that happens, as it has done in the past, it is entirely valid and reasonable for one party to challenge the other if it disagrees with the decision.

Deputy Willie O'Dea

It may be usual for bodies to differ in respect of legal opinion but it is most unusual for a Government to challenge its own statutorily appointed regulator and immediately to seek legal advice after a two-year period of intensive research leading to a detailed report. From the Minister's response, as well as from her contributions earlier, I detect that the only way she will comply with the directive she was issued by the DPC is if she is dragged into court, at the expense of the taxpayer. She stated that is her only option and earlier stated it would be illegal to comply with the directive issued by the DPC, but there is no basis for that. What reason does she have? I asked earlier to see the legal advice and it has now emerged the legal advice did not come from the Office of the Attorney General. Instead, it came from an external lawyer who was given the brief after the DPC had reported and who was able to conclude, in a short space of time, that two years of research meant nothing. I again invite the Minister to publish that legal advice or at least a summary or analysis as to why, how and in what way the DPC was wrong. I do not want a private briefing with officials in the Department but rather something that can be put into the public domain.

The Minister will be aware that a number of other public bodies, such as the Road Safety Authority and the Departments of Children and Youth Affairs and Foreign Affairs and Trade, have decided not to insist on the production of a public services card to access the services they provide. That indicates that those bodies are much less certain of the legality of the matter than is the Minister. She must also be aware of a report by the Comptroller and Auditor General in 2016 that was highly critical of the public services card, and that the report by the DPC we are discussing found, and demonstrated clearly, that many of the so-called benefits claimed for the public services card were illusory. The report is exhaustive and crystal clear, and I have no doubt it will be vindicated legally when the time comes.

The Government's approach damages Ireland's reputation as a good location for international tech companies. As Professor Eoin O'Dell, an expert in the subject, put it in The Sunday Business Post on 23 September 2019, "A government in such open conflict with the DPC can have no credibility in seeking to ensure that such companies comply with the commission’s decisions." The conflict between the Government and the DPC, despite the protestations of respect and so on, creates the impression to outside observers that if a company is ruled against by the DPC, the company could enlist the aid of the Government and get the commissioner's decision overturned.

That is an unhealthy state of affairs.

A number of other investigations are under way. There is an investigation into the biometric qualities of the photograph on the card. There is also an investigation into whether the independence of one of the data protection officers was compromised by a directive he received from above. There is a draft report on that matter and my information is that it finds that person's position was compromised and the Department is at fault. In view of the detailed report from the Data Protection Commissioner, could the Government not cease the practice of allowing public bodies to insist on the production of a PSC for essential public services? Neither the Department of Foreign Affairs and Trade, the Department of Children and Youth Affairs nor the Road Safety Authority is insisting on this so why should other public bodies insist on it?

The Minister quoted at length this morning about the popularity of the PSC. I agree and I do not deny for a moment that the card is popular. Many people find it useful but why must it be mandatory? This question has not been answered. Will the Minister specifically address it in her reply? If somebody can produce the requisite proofs to get a passport or whatever else, why is it necessary to go through the process and hand over the data to obtain a public services card before having to produce it? There are many jurisdictions in Europe with an identity card but the systems operating in them have safeguards that are much more secure than anything in this country. I ask the Government to cease this headlong rush towards what in effect is a national identity card. There must be a proper debate on this in the House rather than statements limited to five-minute contributions. That should happen not only in political spheres but in civic society.

Deputy John Brady

This morning, during Question Time, the Minister rhymed off examples of how the PSC is so convenient, citing the 70,000 citizens who used the card to apply for passports while failing to mention the fact that they had no choice but to apply for the card if they wanted to get passport. Other examples cited included further services that could not be accessed without a card, including SUSI, the National Driver Licence Service and the national childcare scheme. It is not so much choosing the public services card for convenience but rather having no other option. It was in no way convenient for people needing to apply for a passport to first have to apply for and wait to get a PSC and it did not result in their application being processed any faster; moreover, the Department of Foreign Affairs and Trade has stated that introducing the card as a mandatory requirement for all passport applications would have a "significant negative impact" on processing times.

I welcome the move by that Department to remove the card as a requirement to apply for a passport, as was the case in some instances. The Department clearly does not share the confidence of the Minister and the Taoiseach in the legality of the card beyond social welfare supports. I also welcome the Taoiseach’s comments that the card will not be a requirement under the new national childcare scheme. I understand the Department of Children and Youth Affairs is exploring an alternative to the card, albeit late in the day. The Minister might be content with the position she has taken but other Departments are clearly not as content.

Every time she talks about the card, she mentions high levels of satisfaction based on a survey of 1,000 people. This tiny sample equates to "strong public support" according to the Minister but a survey does not excuse illegality. Convenience is not an excuse for the Government to violate a citizen's right to privacy. Popularity is irrelevant when required use of the card has been found to be illegal outside the Minister's Department. The Department has argued to the DPC that there is "no evidence of dissatisfaction with the SAFE process and public services card" but this is contradicted by the Data Protection Commissioner in her report and a long list of media reports. The Minister knows that this statement is untrue. Her Department received complaints, along with the Departments of Public Expenditure and Reform and Foreign Affairs and Trade, and issues came to light with citizens who were adopted and who were unable to access the card without providing an adoption certificate. There were long delays for people applying for the card in order to be able to apply for another service. Instead of making access to public services easier, the card excluded people from accessing basic public services and cut people off from their legal entitlements where they did not have a public services card.

It would be remiss of me not to mention the despicable attitude of the Minister and her Department towards the Data Protection Commissioner by threatening legal proceedings when she did not get her way on seeking additional time to respond to the draft report. The Minister sent 470 scanned pages to the commission as a response and has continuously raised the fact that the commissioner has refused to meet her as requested to discuss the report. She has been corresponding with the Data Protection Commissioner on the matter for over two years. We have seen the correspondence and the Minister was given the opportunity to respond to her findings in the draft report. It was not enough and nothing provided to the commissioner made a difference to her findings. It is clear she has no intention of backing down from her position and I hope she knows the consequences if she is wrong.

The Minister has stated that her only option is to appeal any enforcement notice issued by the Data Protection Commissioner, which is fundamentally wrong. It will expose the taxpayer to serious financial penalties and legal costs. There is another logical option available, which is to abide by the findings of the commissioner.

Deputy Bríd Smith

I will start by reading from the report of the Data Protection Commissioner. It states, "The law does not confer power on a specified body to insist upon the production of a PSC for the purposes of a transaction with it where a person does not already have one." This means that if a person is conducting a transaction with such a body, that person does not legally have to agree to have the data of the Department of Employment Affairs and Social Protection used to get a PSC for that transaction. The body cannot refuse to deal with the person because he or she does not have a card. The report indicates the indefinite retention of personal information by the Department is illegal and the Department is breaking the law by not informing people of how information kept by one public body may be shared to another.

The Minister is refusing to accept the ruling of the commissioner and is prepared to go to court with public money to contest that ruling. To most people, that seems like a fairly sound judgment on the misuse of data from individuals in the country. It is probably simple enough to adjust this if she examined other legal means rather than going through the courts. This will not make her very popular and, needless to say, there will be much public money spent on this exercise. The big questions are why is the Minister doing this and why is she persisting with this? There were other cases where she was warned that the card did not comply with the law. According to her, the commissioner is wrong and she must take the commission to court on that basis.

We can look at how the DPC has been beefed up quite seriously.

Its annual budget grew from €1.9 million in 2014 to €15.2 million in 2017. Over the same period, staff numbers grew from 31 to 180. That was a serious investment in the role of the Data Protection Commissioner and the Minister is about to tell the commissioner that she does not accept her recommendations, she is taking her to court and is unwilling to believe her findings. The Minister is not telling us why, only that she has legal advice that counters the commissioner's opinion. On the other hand, there must be other options open to her but she is refusing to take them. I contend that the reason for that is that this State, this Government, is bent over backwards to send a message to the data corporation giants across the world that they should open headquarters in Dublin because the regulations are lax and the taxes are low. Those companies can do what they need to do because low-touch data regulation will be the order of the day for Google, Facebook, LinkedIn or any of the other tech giants based in Ireland.

The Taoiseach addressed the digital summit in Dublin last week and many of the giant tech companies were present. In that address, he extolled the virtues of the digital revolution and a keynote speaker, one of the heads of Google, commended the Government on its tremendous leadership on digital policy. That is not apparent from what the Government is doing at the moment. The Government is signalling to the giant companies that it is okay and they are in safe hands if their data protection issues go wrong.

The Minister is undermining the Office of the Data Protection Commissioner and the general idea that data protection is important and, indeed, she may embolden the giant technological corporations to refuse to comply with data protection concerns in the future. It is clear that there are other avenues open to the Minister. She needs to explain clearly why she is contesting the finding of the commissioner. She must tell the House not just that she has legal advice that disagrees with the commissioner but what that legal advice is telling her. The Data Protection Commissioner is very clear that people cannot be forced to accept this card they have been told they must have if they want to get a passport, driver's licence or other day-to-day necessities. The Department cannot indefinitely hold on to the personal information. The Department is breaking the law. The Minister says that is not the case but has not told us why. It is outrageous and there must be a political reason behind it. That reason is to signal to giant tech corporations that they are in the safe hands of a Dublin Government, led by Fine Gael, which is willing to spend public money needlessly and ignore the advice of the independent data commissioner. It is an outrageous decision but the Minister has time to pull back from it and she should.

Deputy Catherine Connolly

I sought a copy of the Minister's speech but none was available so I am not 100% au fait with its contents, although I heard her refer to the Comptroller and Auditor General. If one is referring to the Comptroller and Auditor General, there is a duty to read all of his report and there are 15 pages in that chapter. When I hear somebody quoting the Comptroller and Auditor General, without looking at all of the relevant chapter, I must take them to task. His report points out that a key element in project planning is the development of a business case, setting out the objectives to be achieved and explaining the basis for the decision to proceed. There is no single business case documented for the PSC. The Comptroller and Auditor General is very fair and says that elements of a good practice business case were included in several documents; however, there were a number of omissions or partly addressed matters.

The conclusions of the Comptroller and Auditor General are also interesting and are covered in the Data Protection Commission report, to which I will come. There was a contract for 3 million public service cards to be delivered. It was originally intended, the Comptroller and Auditor General states in his conclusion, that 3 million public service cards would be produced by the end of 2013. That did not happen and I am not sure what happened about that breach of contract but, by the end of June 2016, that amount had reduced to 2 million and it was clear that target would not be reached. The Department, at that stage, expected the cost to be €60 million to develop and issue the cards. That did not include activating or renewing them and those were the costs applied when this chapter of the report was done in 2015 or 2016. The €60 million was to apply up to the end of 2017. The Minister might update us on the total cost to date and the future cost envisaged and whether a business case has been done in the meantime.

The report of the Data Protection Commission quotes some of those facts from the Comptroller and Auditor General. I am not sure whether I am more shocked by the findings of the commissioner or the reaction of the Government because they both shock me. I have read the report and some of it with difficulty because it is a full report. The Data Protection Commissioner tells us that the introduction of the public services card has implications for all members of the public in data collected, required, stored and shared and so on. It is not only about privacy but also about control and foreseeability, that the person knows and has some control over the information being collected.

Prior to this, my colleagues and I repeatedly raised our concerns about this card. We were derided, laughed at and, at best, ignored. It has taken this very detailed document to outline the concerns. There were significant gaps in the legal basis. There was no legal basis under the Acts for the Minister's Department, or any other Department, to process personal information. It would be helpful if the Minister would listen when she is finished having a chat because I have only a few minutes and this is an extremely serious issue. The report also stated that the blanket retention of information is not acceptable and that there are huge problems over transparency and so on.

How will I use the minute and a half I have left to get through to the Minister? Rather than trying to rush through it, let me say that a sensible Government would realise that the concerns raised by those of us who were put on notice by organisations outside the Dáil have now been set out clearly in this report from the commissioner. A wise Government and Minister would look at that report and ask what they can do and take it on board to improve the system.

I see not only denial but an arrogant justification. The response of the Department was nothing short of contemptuous when it gave back some 700 unpaginated pages in response to a draft report. The Minister had that draft report in August 2018. She was on notice for years before the data commission, or whatever it was called at the time, had serious concerns. Each year, in its annual report, it put the Minister on notice that it was concerned about the functional creep, the failure to outline a policy and the failure of legislation. The Minister has made much play of the legislation. I do not have the time to tell the Minister how many amendments have been made to the legislation in a piecemeal, fragmented fashion. The office of the commissioner was obliged to put a consolidated version together and publish it on its website to help the public to, in some way, understand what was going on. The Department subsequently decided to publish an informal consolidated document.

At this stage, all I can do is use my voice in the Dáil to say it is contemptuous of democracy for a Government to proceed in this fashion. It has the most serious implications for us when we go out and ask people to believe us on the street.

An Ceann Comhairle

We move on to the Rural Independent Group. Deputy Mattie McGrath is going to share time with Deputy Michael Healy-Rae.

Deputy Mattie McGrath

Ar an gcéad dul síos, ba mhaith liom buíochas a ghabháil leis an Aire as ucht teacht go dtí Cathair Dún Iascaigh cúpla seachtain ó shin ar a chuid laethanta saoire. I thank the Minister for attending a very nice occasion in Cahir recently. All the attendees were very impressed with her. I was delighted she could attend, especially as she took time out of her summer holidays. We appreciated that and I thank the Minister for her interest in the issues that were raised with her.

On the other hand, on this issue-----

Deputy Regina Doherty

There is a "but" coming.

Deputy Patrick O'Donovan

I thought there was something else coming.

An Ceann Comhairle

That seemed too good to be true.

Deputy Mattie McGrath

I believe in praising the bridges one goes over.

Deputy Patrick O'Donovan

And burning them afterwards.

Deputy Mattie McGrath

I do not burn them, unless I have to, although I might burn a few around you, Minister.

This issue raises fundamental challenges in important areas such as data protection, privacy, the proper or improper use of public money and the very credibility of the Office of the Data Protection Commissioner.

The Data Protection Commissioner has been clear, however, that it is a misunderstanding to think data protection law is directly and only concerned with privacy. In fact, as she noted in her report, it involves a far broader area of law that in many cases has less to do with privacy, as the term might commonly be understood by people, including me, and more to do with how people exercise control over their own information. That highlights the key issue for me, quite apart from the estimated cost of the card project to date of around €60 million. The commissioner also highlighted another extraordinary fact that has been commented on little, namely, that no public sector body has invested in the technology capable of reading the chip that contains the encrypted elements of the public sector identity data set on the card.

It has been bizarre to watch the very public squabble between the Data Protection Commissioner, the Minister and the Department, it seems each taking their own separate view, although I suppose that is not bad. It seems the Government has a habit of pushing ahead with projects that may have a shaky legal basis. I understand new smart CCTV camera schemes which have the potential to provide for facial recognition have been introduced in cities such as Limerick and towns such as Duleek in County Meath. Some 14 towns in County Limerick are to have 44 smart CCTV cameras, the information from which will be linked with data from environmental footfall sensors, as well as number plate recognition systems. As a result, the Data Protection Commissioner has stated her intention to appoint a special investigation unit later this year to conduct a comprehensive nationwide investigation into CCTV camera schemes. The Minister might tell us if it is another project that is doomed to fail?

Deputy Michael Healy-Rae

The implications of what we have seen happen in the area of data protection in the past 12 months will make our job as public representatives very difficult. I refer not only to what has happened with the public services card but also to more far-reaching issues which have not yet come to light. The simplest things we deal with in day-to-day inquiries involve people's sensitive information. It is one thing every public representative in this House has, whether it be names, PPS numbers, dates of birth, personal details or other information people living in their houses would not have, but we have it as part of our work. We need it. In our interactions with the Department of Employment Affairs and Social Protection, for instance - it could also be the Department of Health - we must discuss people's very private business. Every one of us is responsible in the way we hold and store that information. However, I can foresee difficulties that we do not yet realise and it is all due to data protection. It is the big elephant in the room or the monster that is out of control. It will be problematic and cause major difficulties. It will disrupt us in trying to do our job properly to help people and communities. I can see it being a big problem for us in the future. How we deal with it will be a problem for all of us.

Deputy Catherine Murphy

I was not in the Chamber when the Minister opened the debate, but I listened to what she said. In some of it she repeated mantras about access to public services. However, it is important to note what the Data Protection Commissioner said, that instead of it being an enabler for citizens to receive their entitlements, the public services card was being used as an impediment. We need to pay attention to this.

The Minister also said it was not a national identity card. If it will be required to apply for public services - it may have other uses, something highlighted by the Data Protection Commissioner it will de facto become a national identity card by stealth. If we are to have a national identity card, let us have a debate on the issue and consider the legislation that would be required. The report sets out clearly that there is no legal underpinning for the card.

The card features a chip, yet no public sector body has invested in technology capable of reading it. There may be incorrect information on the card, yet people are not in control of this information that is being held on them by public bodies. Anyone seeking a public services card must provide forms of identification such as utility bills. That is understandable. What is not understandable is the Department's need or desire to hold onto these validation documents instead of destroying them. As data controllers, we are all required to destroy information we do not require.

Fears about what data might be held on file by the Department are very real and well founded. Today's society is acutely aware of the value of data and the importance of being digitally aware. This is National Fraud Prevention Week, during which there have been advertisements on television and radio warning people to be careful with their data.

I have asked about 70 questions about this issue in the past few years and engaged with the Minister in the House on various aspects of it. There is a feeling a dismissive attitude has been taken towards concerns that have been raised by me and others and which were subsequently raised in the Data Protection Commissioner's report. We await hearing the Data Protection Commissioner's view on whether photographs and how they are taken and stored are biometric data.

The job of legislators is to look below the surface. The card might be presented as being useful in accessing public services, but what if something goes wrong? That is where our scrutiny is important. State bodies are key targets for hacks and data breaches as they possess so much valuable data on citizens. We need the upmost security in that regard. Holding onto data that are not necessary is part of this question. We must also be mindful of the State's exposure for losses incurred. Has a contingency amount been set aside if the State is exposed? What consideration was given to this aspect of the scheme?

I reiterate points raised by others, including the dissatisfaction felt by people who believed they had no choice. To use the Minister's words, it might not have been compulsory but it was mandatory. People cannot access services in the Department of Employment and Social Protection without it.

It is mandatory from that point of view but it is not compulsory to have it. It is not compulsory if one does not want the payments. This is a serious report that has been presented. The Data Protection Commissioner has been hugely undermined by the Department's response and this has a long way to play out.

An Ceann Comhairle

We move to the second part of this process, where we will have five minutes for questions and answers from each of the groups present. I suggest we take two questions before going back to the Minister for an answer and if there is time for two more questions, we will go back.

Deputy Willie O'Dea

I ask the Minister again if it is her intention not to produce in the public domain even an analysis of the legal opinion she has got. Apparently it flatly contradicts the conclusion of the Data Protection Commissioner.

The Minister mentioned she has tried twice since the report was published to have a meeting with the Data Protection Commissioner, and the Data Protection Commissioner has apparently turned down that invitation. Did the Data Protection Commissioner ever fail or refuse to meet the Minister or the Department in the past? Why does the Minister suppose she is refusing to do so now?

Deputy Regina Doherty

On the day I published the findings of the report, I also published a detailed analysis of our response to the report. While that does not give the Deputy details of the legal opinion, it gives him the robust reasons we believe there is a legal basis for us to continue the practice we-----

Deputy Willie O'Dea

It most certainly does not. Do not mislead the House.

Deputy Regina Doherty

I ask the Deputy to withdraw that remark or explain it.

Deputy Willie O'Dea

The Minister is perfectly well aware-----

Deputy Regina Doherty

The Deputy should either withdraw the accusation he has just made that I am misleading this House or he should explain himself.

Deputy Willie O'Dea

I asked for the legal opinion the Minister got, which in this case should be published, because we are talking about two years of careful research, a detailed report and careful analysis. The Minister is saying she will not produce the legal advice the Department got that contradicts that. I am saying to the Minister she should produce a detailed analysis of that legal advice.

Deputy Regina Doherty

The Deputy should explain how I have misled the House because that is what he said.

Deputy Willie O'Dea

The Minister is trying to pretend she has produced such an analysis-----

Deputy Regina Doherty

No, I am not.

Deputy Willie O'Dea

-----whereas she has not.

Deputy Regina Doherty

No. The Deputy should go back and listen to what I said.

Deputy Willie O'Dea

The Minister has produced neither the legal advice nor the analysis. If she looks at her reply to me-----

Deputy Regina Doherty

The Deputy should go back and listen to what I just said.

Deputy Willie O'Dea

-----the Minister is trying to imply she has produced the analysis but she has not.

Deputy Regina Doherty

The Deputy should go back and listen to what I just said. I am happy to be here to defend the policy that Deputy O'Dea made decisions around the Cabinet table to start. I am because I believe in it-----

Deputy Willie O'Dea

Again, the Minister is misleading the House.

Deputy Regina Doherty

I believe delivering public services in an efficient manner to the people, who we are all here to serve, is the right thing to do and it is important. What I will not do is stand here and have the Deputy challenge me and say I am telling him lies.

Deputy Willie O'Dea

The Minister has misled the House, not once but twice.

Deputy Regina Doherty

I do not deserve that. I come here in good faith. I am happy to defend a policy that the Deputy instigated when he was sitting around the Cabinet table in 1998 and 2005.

Deputy Willie O'Dea

No, I did not. The Minister is misleading the House again.

Deputy Regina Doherty

My Government and the previous Government happily extended that policy-----

Deputy Willie O'Dea

The Minister is misleading the House again.

Deputy Regina Doherty

-----and I am happy to defend it because I believe it is the right thing to do but I will not take the Deputy's guff calling me a liar.

Deputy Willie O'Dea

If the Minister thinks she will intimidate me-----

Deputy Regina Doherty

I am not intimidating anyone. I am sticking up for myself for once.

Deputy Willie O'Dea

-----she can think again and she should not talk down to me either.

Deputy Regina Doherty

I am sick of the Deputy.

Deputy Willie O'Dea

The Minister has misled the House twice in my opinion. She mentioned this policy was instigated by Fianna Fáil. Is she aware the legislation we introduced is the legislation which the Data Protection Commissioner found does not provide any legal underpinning for extending the public services card to other bodies?

Does the Minister accept the open conflict between the Government and the Data Protection Commissioner sends out a bad signal to people looking in from outside the country? It sends a signal that the Data Protection Commissioner is not particularly well got with the Government and it sends a signal that if people locate in this country and the Data Protection Commissioner rules against them, they can enlist the Government to help them out.

Does it remain the Government's policy to extend the public services card on a mandatory basis to anybody who is trying to access essential public services? Will there be no choice and will it be fully mandatory? Is that the Government's policy? Can we have a clear and unequivocal statement on that?

Deputy Regina Doherty

On the first question the Deputy asked me earlier on about our two requests for a meeting with the Data Protection Commissioner, I cannot answer why the Office of the Data Protection Commissioner refused the meeting. No other meeting before those requests has ever been refused. We had extensive engagement on this investigation and on a number of others over recent years since the inception of the Office of the Data Protection Commissioner.

I do not accept there is an open conflict. I accept the legislation that was passed by this House gave us the authority and ability to do exactly what we are doing, as it gave anybody else who had adverse findings made against him or her by a quasi-judicial authority such as the Data Protection Commission the authority to challenge those findings in the legal courts, particularly if he or she does not agree with them. I have strong and legally robust advice to tell me we have a legislative basis to do exactly what we have done.

Deputy John Brady

I want to ask a question on the overall cost of the card. We know €62 million has been spent on the roll-out of the public services card so far. We also know that in the region of €2 million was ploughed into the project of making the public services card a requirement for getting a driving licence. Can we have an overall figure for the roll-out of the card across all Departments?

Earlier this month, the Minister for Transport, Tourism and Sport, Deputy Ross, said his officials were vindicated over the stance on the public services card for driving tests. Did the Minister get legal advice on withdrawing the requirement for driving tests? Did the Department of Foreign Affairs and Trade get legal advice before it withdrew the requirement for passports?

Deputy Regina Doherty

Can I confirm if, in the second last question the Deputy asked me, he is asking if I got legal advice or if the relevant Department got legal advice?

Deputy John Brady

I asked whether the relevant Department got legal advice.

Deputy Regina Doherty

The first question the Deputy asked was on the costs. The Comptroller and Auditor and General estimated the costs of the public services card project to the end of 2017, which are the only current data figures we have, came to €59.7 million. That cost is made up of €30.9 million for the managed services contract, the software, the hardware, support, maintenance and administration of the card itself. An estimated €28.8 million was for the Department's staff costs, based on the Department's request for 200 additional staff for a four-year period. The estimated staff costs only covered those directly involved in the public services card project and did not include the staff costs of anybody else from the Department of Employment Affairs and Social Protection, such as those involved in the internal upgrade of our IT systems that would have had to accompany the contract we issued. That is how the €59.7 million was made up.

I cannot say why the Minister for Transport, Tourism and Sport, Deputy Ross, said what he said other than to say I am not responsible for the delivery of policy-----

Deputy John Brady

Did he get legal advice?

Deputy Regina Doherty

I am answering the question the Deputy asked before that. I cannot say why he said what he said. I am only responsible for delivery of policy in my Department. I do not know if he got legal advice, and to answer the same question, I do not know if the Department of Foreign Affairs and Trade got legal advice on its policy formation.

Deputy John Brady

Who decided on the format of the Department's response to the draft report from the Data Protection Commissioner? Was the Minister aware the responses were being sent in 470 scanned and unpaginated pages? Why was it done that way?

Does the Minister still believe there is no evidence of dissatisfaction with the public services card? Simple "Yes" or "No" answers will suffice.

Deputy Regina Doherty

An entire team of people across the Department of Public Expenditure and Reform, my Department and the Office of the Attorney General was responsible for sending the response back to the report from the Data Protection Commissioner. What was the second question?

Deputy John Brady

Why was the response sent in the format it was sent in? The response came in 470 scanned and unpaginated pages. In other words, the pages were not numbered, a fact of which the Data Protection Commissioner was highly critical.

Deputy Regina Doherty

I do not know why that was done, to be honest. We provided the information as it was required. I said on previous occasions that the response to the original report in December 2018 was extensive. It went to 470 pages and so we replied with all the information requested of us and some.

What was the last question the Deputy asked me?

Deputy John Brady

I only had five minutes. I asked my questions and I think the Minister-----

Deputy Regina Doherty

I beg the Deputy's pardon. He asked about the evidence. The research speaks for itself. It does not say that 100% of Irish people were happy with it; of course some people are not.

Deputy John Brady

I have a couple of questions. The Minister is trying to talk down the clock. Are there still plans to explore the possibility of replacing the medical card with the PSC, and has the Minister had any involvement in such discussions? How does the Minister define low-risk categories? It seems some people who received the card did not go through the SAFE 2 process.

Deputy Regina Doherty

I was not aware of any plans to extend the medical card until I read about them in the newspaper, which is presumably where the Deputy read about them as well. I cannot answer a question about plans of which I was not aware in the first instance.

To answer the Deputy's previous question, a scanned PDF document was sent to the DPC to assist it in searching the document. That is why it was sent. I do not have data on how we classify people of risk, because we want to treat everyone equally. That is why 3.9 million people have volunteered to come in, go through the SAFE 2 process and have their identities authenticated.

Deputy Bríd Smith

I have two questions. The first one probably has a yes-no answer. Has the Minister or anyone in her Department been lobbied by any of the giant technology companies on this, or as the Taoiseach put it regarding other instances of lobbying, "had a cup of coffee with them"? Perhaps they sat over a cup of coffee and chatted with them.

Deputy Regina Doherty

Which companies?

Deputy Bríd Smith

I refer to any of the giant technology companies. Have they lobbied the Minister or anyone in her Department, had meetings or coffee with them, or whatever way one might describe it?

Since the Government is hell-bent on legally challenging this report, has it estimated the cost of such a challenge?

Deputy Regina Doherty

The answers to those questions are "No" and "No".

Deputy Catherine Connolly

I want to correct the record regarding a statement I made earlier. The Department's response to the report was 470 scanned pages. The reference is on page 20 of the DPC report, in paragraph 13. It notes that the response was unpaginated and included 28 appendices.

Has a business case been carried out in respect of this project?

Deputy Regina Doherty

The supporting documentation for the project was released to the DPC in December 2018. Not only was there a business case, but the supporting documentation on the questions and answers, transparency, and privacy was laid before the commission as a response to the initial draft report in 2018.

Deputy Catherine Connolly

Was a business case carried out? If so, where is it and on what date was it done? I refer to the report's findings. Is the Department appealing all the findings? I presume it will not challenge the first finding, which finds in its favour, but is it appealing the other seven?

Deputy Regina Doherty

I do not have the exact date for when the business case was designed but I can come back to the Deputy on that.

In response to the second question, I am appealing all eight findings. However, I am not currently in a position to appeal anything as nothing in the report is legally challengeable. At this stage, all we can do is say we disagree with all eight findings as presented to us on 15 August.

Deputy Catherine Connolly

The business case is particularly important. There was no business case at the inception. The Minister stated that 3.9 million people now have cards. Can she explain when the business case was done? Did it set out the benefits, savings, and so on? If so, when was it done, and what was the total number of cards given out? Have the activation and renewal costs been included, as the cards run out after a period? Is that all set out in the business case?

Deputy Regina Doherty

My response is the same as previously. I do not have a date for when the business case was established but I can come back to the Deputy with it later today. The total number of cards issued to date is 3.9 million, which have been issued to 3.2 million people. Some people lose their cards and need to get a second one, and others reach an age where they need to change their cards to add free transport, and so on. There are 3.2 million active users, and 3.9 million cards have been issued to date. The card production company has been paid €29.2 million; the staff costs associated are estimated at €36 million; the facial matching company, Gemalto, has been paid €294,000; and the miscellaneous costs are €2.3 million.

In response to the Comptroller and Auditor General's findings - I ask the Deputy to stop me if this is of no use to her - the Department stated that the project was innovative and given the lack of existing comparators, it was not possible to properly estimate the costs at that time until market testing via procurement processes had taken place. That gave rise to some of the Comptroller and Auditor General's findings at the time, which have subsequently been established through practice and further information.

Deputy Catherine Connolly

I have no more questions. The business case is vital, because the Comptroller and Auditor General's report should not be used in the way it is being used. The Minister should read all of it. She is quoting arguments that were put by the Department at the time in response to concerns raised by the Comptroller and Auditor General. One of those concerns was that this was a new technology. Surely at some stage that would be tested through a business case.

I am not reassured that the Minister is taking any of the concerns set out in this detailed report on board. There are serious concerns in respect of the retention of data without a legal basis and other Departments using the card or demanding it without a legal basis. Surely at this point the Minister, separate from the Department, would have some sense to examine this and see what is happening here. After all, the Government has been aware of this for a long time. The commissioner has made his concerns known every year in his report. I have mentioned some of those concerns and I ask the Minister to address them.

Deputy Regina Doherty

The original Comptroller and Auditor General report found that the Government indicated no business case. He found that the Government made decisions in 2004 and 2005 that formed the basis of the PSC project, and that a business case or project plan was not developed at that time. However, following examination of key project data and documents that were supplied to our Department by the Department of Public Expenditure and Reform, the Comptroller and Auditor General then found that the elements of a good practical business case were included in several documents he had examined. Despite this, he found that there were still a number of omissions relating to a comprehensive estimate of the total projected cost, including the allocation to existing Departments. It has since been provided and I have just provided it to the Deputy. There was no initial assessment of the Department's ability to deliver the project, and a formal assessment was not provided at the initial stages of the project. It has since been provided to the Comptroller and Auditor General and been accepted. He also highlighted that there was no plan setting out how the project's benefits would be measured. We have replied to that, noting how recipients feel about the card and how valuable they find it.

Deputy Catherine Murphy

When the report was received at the end of August, the Government committed to publishing it. Subsequently, The Irish Examiner asked for the publication of the report in a freedom of information, FOI, request and was told that it would not be in the public interest to do so. The response also said that publishing the report would have serious adverse effects on the Government's ability to manage the economy and financial interests of the State. The Department then published the report within a few days of that FOI response. How can the Minister account for the significant variation in responses?

Deputy Regina Doherty

I did not answer that FOI request, as is the norm in most Government bodies. The people who reply to FOI requests do so in the best interests of the Department and according to the established legal plan that sets out our response. I take a slightly different view insofar as I feel we should robustly defend the policy we have instigated over several Governments. I am proud to do so, because I believe in it. In an era of transparency for both Members and the public we serve, I think - and have said previously - that we should have published the report. However, I was in a position to do so only when I was completely satisfied we had fully established our plan. That is why it took until last Tuesday.

Deputy Catherine Murphy

I share the concern about this, and perhaps the Minister could comment on the Government's ability to manage the economy and the financial interests of the State. Where is the risk? What was the identified risk that presented such a response?

Deputy Regina Doherty

I cannot comment, because the person who answers FOI requests does not respond or directly report to me. If I attempted to question his or her direct response back to the person who requested it, we would be in a whole different space here. Perhaps the Deputy would ask for that information through the FOI system, because I certainly do not share that view.

Deputy Catherine Murphy

I will submit an FOI request to that person.

What provision has the Minister's Department made with regard to the liability relating to the PSC scheme? Has the Minister any comment on the mass action by Digital Rights Ireland under the GDPR against her Department?

Deputy Regina Doherty

We only make provision in the Estimates, and given that this was only received on 15 August this year, there is no provision in this year's Estimates for it. I cannot comment on something that I read in the newspapers that we have no knowledge of. I am sorry but I am not in a position to do that.

Deputy Catherine Murphy

I will now go back to a point about the Department of Transport, Tourism and Sport raised earlier. Presumably that Department went to and received advice from the Attorney General on such an issue. Would the Department go outside for advice on it? It is extraordinary that the Department of Transport, Tourism and Sport, and now the Passport Office, are at variance with the Department of Employment Affairs and Social Protection on the findings of the Data Protection Commissioner. That is certainly how it reads. Perhaps the Minister will comment on that.

Deputy Regina Doherty

I do not know if that Department got advice, other than what has been said to me here this evening. It is not my business what other Ministers do around the rolling out of their policies.

I disagree with the Deputy that there is a variance with any Department on the assistance that a PSC gives when delivering public services. We are all at one when saying that if people have a card, it makes the delivery of public services through eGovernment much more efficient. People only have to prove their identity on a one and done basis and it makes access with all of the other Departments using eGovernment services much more efficient. It is, however, not exclusive. There are ways of dealing with Departments outside of the PSC, as is the will or the wish of the relevant line Minister.

Deputy Catherine Murphy

That is the point. There is a challenge in the report about the card not being an enabler.

On a couple of occasions the Minister commented that she was very surprised the Data Protection Commissioner was not acceding to a request for a meeting. Did the commissioner not say that this was a final report? Once a report is final, one either accepts it or does not accept it. There is not a meeting because it is a final report. From reading the report it appears that the commissioner was heavily engaged with the Department during her consultations, and that was the time for engagement with her. Does the Minister agree that the reason no meeting has happened is because it is a final report?

Deputy Regina Doherty

A number of things have been said about me here today: that I have been dismissive of Members, that I am arrogant; and that I have been incredulous about the commissioner's refusal to meet us. If I have ever been dismissive of any Member, I give an apology right here and now. That was never my intention. I understand that we have differences of opinion on a wide variety of policy delivery in the State. That is okay. It is healthy and normal. I do not, however, believe that I have ever disrespected any Member in the House. I have certainly never disrespected the DPC or any of the staff members in the commission's office. I asked twice for the meeting, not because I wanted to challenge the legal findings in the report, but because there were inconsistencies in the directions in the report, the directions in the letter that accompanied the report and the utterances made by Data Protection Commissioner in three interviews. I am at a loss to know what exactly I was supposed to comply with and all I wanted to do was sit down and have a conversation so I could rule out the inconsistencies and know exactly what the directions are, so when I was deliberating on what we were going to do around the directions, I would know exactly what I was deliberating on. I do not think this was too insulting. I do not believe it was questioning the commissioner's authority, and it was not questioning the findings in the report given that there were inconsistencies across the three mediums.

An Leas-Cheann Comhairle

Before I ask the Minister to conclude, I call Deputy Mary Butler. As we have time to spare, there is an opportunity for her to ask a question.

Deputy Mary Butler

Since the ruling of the Data Protection Commissioner, it is no longer necessary to use a PSC when applying for a passport. Does the Minister accept that it undermines the position she has adopted when other Departments do not support that position, have changed their terms and conditions, and are adhering to the commissioner's ruling?

Deputy Regina Doherty

It is not a ruling. That would give legal authority to it and we do not want to find ourselves in a position of not being able to legally challenge. As far as I am aware, the Department of Foreign Affairs and Trade has not changed its policy at all. There was always a mechanism to get a passport without a PSC, and that remains true today. There was no change.

An Leas-Cheann Comhairle

The Minister will now conclude.

Minister for Employment Affairs and Social Protection (Deputy Regina Doherty)

The PSC has received much public attention over the past number of weeks and I genuinely hope that some of my comments today I have provided some clarity on some of the misunderstandings that have played out in the media over recent weeks.

There have been claims that the card was only conceived in recent years or that it was initially intended as a pilot for social welfare purposes and that there has been mission creep since its introduction. The fact is that the card had its genesis back as far as the 1990s. The purpose was very clear then, but it is also very clear to me today, that it was to provide a means of verifying a person's identity when accessing public services. There has been no mission creep, as the intention was clear from the outset, and we have delivered on our mission.

There are now approximately 3.2 million active users of the PSC, representing more than 80% of the adult population. The PSC provides citizens with the convenience of only having to submit information to verify their identity once. In this context, it should be noted that every week payments valued at approximately €150 million are made via post offices to more than 600,000 people whose identity is verified on each and every occasion by use of the PSC. Every week, approximately 600,000 people make free travel journeys using the card. Every year, approximately 70,000 people over the age of 18 apply for a passport for the first time using the card to avoid having to resubmit identity data to that Department all over again. Almost 400,000 PSC holders - and growing, thankfully - have verified their identity to standard that enables them to access a wide variety of online services with the bodies mentioned above via MyGovID.ie.

I reiterate - and I must be getting through because Members have mentioned it on several occasions - that the PSC has strong public support. Almost 89% of the adult population hold a card and research commissioned from a reputable research agency by my Department published on 1 March this year shows that 96% of cardholders surveyed were either very satisfied or fairly satisfied with the process.

Deputy John Brady

It does not make it legal.

Deputy Regina Doherty

Almost nine out of ten people agree that it is very useful that other Government service providers may be able to use the identity information provided in obtaining the PSC to avoid the need to provide the same information again. Of those surveyed, 88% felt that they either had access to the right level of information in respect of the SAFE-PSC process or had access to more than the information they needed. Almost eight out of ten people, which is 77%, understand the requirement to retain personal information and do not mind that their documents are retained.

The public service identity, PSI, dataset can only be shared with public service bodies set out in legislation, called "specified bodies", and where that body has a transaction with a person and can be shared only to the extent necessary for that transaction to authenticate the identity of the person concerned. Specified bodies are, in all cases, required to process and store data in accordance with the GDPR and the Data Protection Act 2018. The personal data associated with the PSC are the basic identity data as set out in legislation.

I reiterate that I fully respect not only the commissioner but also the Data Protection Commission.

At all stages in its interactions with the commission's office my Department has sought to co-operate fully with the investigation.

I note that the opinion has been expressed that the State should not be contesting the findings of the Data Protection Commissioner, that it should just accept them and implement the measures required. In that regard, it is important to note that the Oireachtas specifically provided - not all of us were here when this happened but some of us were - that bodies subject to first instance decisions of the Data Protection Commissioner would have, in accordance with standard principles of due process and natural justice, the right to appeal such decisions. It would be extraordinary, therefore, if the State where to deny itself the right to exercise this right, particularly in a situation where there is strong legal advice to underpin the card as initiated in 1998.