Dáil Éireann Debate, Tuesday - 18 October 2022
551. Deputy Catherine Murphy asked the Minister for Children, Equality, Disability, Integration and Youth if he has conducted a data protection impact analysis in respect of the HIVE system for the ECCE service; and if he will clarify whether his Department is the controller or processor of data in respect of the HIVE system. [51133/22]
Amharc ar fhreagraThe Department conducted a Privacy Impact Assessment on the Early Childhood Care and Education (ECCE) scheme in December 2016. This PIA was undertaken by a third party - Sytorus. The PIA is a process used to protect privacy by design when an organisation starts or acquires a new business, implements a new process, or launches a new product. The Data Protection Impact Assessment (DPIA) is an on-going process, regularly applied to personal data processing, identifying, and mitigating risks.
As the PIA was conducted prior to the GDPR coming into effect in May 2017, the Department was under no obligation to conduct a DPIA, but nonetheless conducted the PIA on ECCE as this was best practice in relation to new and existing projects.
The National Childcare Scheme (NCS) went live in November 2019, and this was the first scheme to be operated on the Early Years Platform/The Hive. The Department conducts DPIAs on any new schemes being operated on the EYP/The Hive. Sytorus also conducted a PIA on the NCS in May 2017, and Trilateral conducted a DPIA on the NCS in July 2019. Subsequent to this, Castlebridge/Sonas Innovation conducted a DPIA in June 2022 on Core Funding, which went live on in September 2022.
The Privacy Impact Assessment on ECCE identifies my Department as the data controller of data processed in respect of ECCE, and Pobal as data processor. The DPIAs conducted on the other new schemes on The Hive have also identified my Department as data controller and Pobal as data processor.
