A complaint to the European Commission about the lack of independence of the Irish data protection commissioner could cost the State thousands of euros in daily fines if upheld.
POD, the Primary Online Database, wasn’t supposed to be a problem for the government. A single database maintained by the Department of Education containing the full details of every student in the system seemed a perfectly reasonable idea. Who doesn’t love a database to improve efficiency?
But when the idea first went public early in 2015, and people who weren’t inside the civilservice and political bubble had a look at it, awkward questions were raised.
On 7 January 2015, Elaine Edwards reported in the Irish Times that the details of all pupils would be retained until their 30th birthdays, long after they had completed primary education. The following day, the paper reported that education minister Jan O’Sullivan was “willing to examine” the 30-year rule.
A few weeks later, the paper reported on discussions between the Data Protection Commissioner and the Department of Education on the database, while minister Jan O’Sullivan said data would be held for 30 years to ensure “that we have the full maximum data that we need”, a meaningless word-salad.
In early February, it emerged that POD had poorly-thought-out ethnic classifications. In short, “White Irish” was a category, but pupils who were not white could not be classified as Irish, only as “Black African” or “other Black background”. That same month, the department rolled out its heavy guns, threatening to defund schools which did not provide data on all their pupils.
Further questions were raised over other items sought by POD. PPS numbers; religion; and records of physical or mental issues, learning problems and disabilities, were all sensitive personal information, some of all of which could be shared with the Department of Social Protection, the Health Services Executive, or the National Council for Special Education.
By the end of March 2015, the Department began a climbdown, reducing the retention period to until pupils’ 19th birthdays.
In June 2015, the Data Protection Commissioner found POD was unlawful, and would require new legislation, by way of statutory instruments.
Dublin solicitor Simon McGarr, a father of two primary school-aged children, was one of several people with questions about the project, believing it to be excessive retention of data, much of which was being used for purposes other than that for which it was collected. After phone calls to his local school and then the department failed to provide satisfactory answers, he submitted a series of Freedom of Information requests to the department.
The requests were initially refused, and it took until March of this year to have the appeals heard. By this stage, the department had also reluctantly conceded that POD was not compulsory, and could not be linked to school funding. All of the department’s FOI refusals were overturned, with one exception. The Information Commissioner decided that legal advice to the Data Protection Commissioner, which it had shared with the department of education, was privileged communication.
That refusal, and the detail it reveals about the communications and decision-making processes involved in POD, have now prompted McGarr to make a complaint to the European Commission.
“Here is my complaint”, says McGarr:
“It is a requirement, both under domestic Irish data protection regulations and more importantly under article 8.3 of the Charter of Fundamental Rights, that every state ensures that its citizens have access to an independent data-protection authority.
I, it turns out on examination of these documents, have never had access to an independent data protection authority. Therefore I am making my complaint both in relation to the data protection commissioner’s behaviour, and about Ireland and the Attorney General’s behaviour as well”.
It turned out they were giving the department legal advice which the department relied upon, which was the basis they relied upon for the legislative justification for POD.
Therefore the people doing the investigating are the people who came up with the idea in the first place.
“This is about my two kids. I wouldn’t have ground on and on like this if the Department of Education had responded properly when the problems arose or the DPC had been able to independently assess my complaint in a timely way,” McGarr added.
If the commission finds that Ireland has failed in its duties under European law, it can take a case to the European Court of Justice, and apply daily fines – until an independent data protection authority is created.