Dáil Éireann Debate, Tuesday - 28 November 2017
675. Deputy Catherine Murphy asked the Minister for Employment Affairs and Social Protection if the obtaining of data through SAFE 2 and the public services card is fully compliant with the general data protection regulation law including ensuring that ownership of the data ultimately rests with the persons rather than her Department; and if she will make a statement on the matter. [50635/17]
Amharc ar fhreagraThe General Data Protection Regulation (GDPR), which will come into force on the 25th May 2018, replaces the existing data protection framework under the EU Data Protection Directive and imposes a general necessity to have specific legislative provisions underpinning the methods organisations use to process data.
The main legal powers providing for and relating to SAFE registration and the PSC are set out in the Social Welfare Consolidation Act, 2005 (as amended) as follows –
- Sections 262 and 263B provide for the verification of identity to facilitate the issuing and use of a Personal Public Services Number (PPS Number or PPSN)
- Sections 263, 263A and 263B provide for the verification of identity to facilitate the issuing, use and cancellation of a PSC;
- Section 241 provides that a person must satisfy the Minister to his/her identity when making a new claim and sets out how that can be done; and
- Section 247C provides that an existing claimant must satisfy the Minister to his/her identity, sets out how that can be done, and provides for disqualification where an existing claimant fails to so do.
The recently published “Comprehensive Guide to SAFE Registration and the Public Services Card” is available on my Department’s website http://www.welfare.ie/en/Pages/Public-Services-Card_holder.aspx under “Downloads”. This document contains 54 detailed questions and answers which address a wide range of questions about SAFE Registration and the PSC. Appendix 1 of this document lists legislative provisions associated with the Public Services Card.
My Department collects and holds large volumes of personal data on customers and is very aware of the need to have adequate data protection policies, procedures and structures in place in line with the GDPR. Preparations for the GDPR are being overseen by the Department’s Data Management Programme Board which comprises many of the Department’s most senior personnel. The Department has a dedicated GDPR implementation team in place and has commissioned external expertise to assist it with achieving GDPR compliance.
I hope this clarifies the matter for the Deputy.
