Dáil Éireann Debate, Thursday - 3 December 2020
236. Deputy Alan Kelly asked the Minister for Social Protection if her Department has been the subject of an investigation by the Data Protection Commission from 2016 to date; the number of specific investigations underway or completed; the dates on which her Department was first notified of the investigation; the details of the investigation; the nature of the complaints; and if she will make a statement on the matter. [40818/20]
Amharc ar fhreagraMy Department has been the subject of three investigations by the Data Protection Commission from 2016 to date. These are as follows:
1. PSC
On 27th October 2017, the DPC wrote to the Department informing it that it was initiating an own-volition investigation pursuant to Section 10(1A) of the Data Protection Acts into the Department’s compliance with its responsibilities as a data controller in respect of PSC related matters.
On 30th January 2018, the DPC notified the Department of its intention to split the investigation into two modules, with the first module dealing specifically with the issues of:
(i) the legal basis for processing personal data in connection with the PSC;
(ii) security measures in relation to processing operations in connection with the PSC; and
(iii) transparency of information provided in relation to processing personal data in connection with the PSC.
The final report, relating to legal basis and transparency issues, containing eight findings was received by the Department on 15th August 2019, together with a letter from the DPC requiring that the Department take certain measures. The second module has not yet commenced.
The DPC issued an enforcement notice on 6th December 2019, outlining seven Enforcement Steps in line with the findings of the report. The Department carefully considered the notice and sought the advice from the Attorney General’s Office. An appeal against the Enforcement Notice has been lodged.
2. Independence of DPO
The DPC is conducting an own volition inquiry into the independence of the Department's Data Protection Officer in connection with changes to the Department's privacy statement in July 2018. The DPC informed the Department of the commencement of this inquiry in a letter dated 5th December 2018. The Department provided the information required and a draft report was received from the DPC on 28th May 2019. The Department provided its response to the draft report on 24th July 2019. There has been no further activity or correspondence on the matter.
3. Child Benefit Eligibility Certificates
The DPC notified the Department on 18th June 2020 that it was conducting an own volition inquiry to investigate the collection and alleged further processing of the personal data of child benefit recipients (qualified persons) and beneficiaries (children) for the purposes of conducting eligibility checks.
The Department received an extension to the initial deadline of four weeks for responding to the initial notice. In response to an Information Notice issued by the DPC, the Department responded with the requested information by the agreed deadline of 27th November 2020.
