A LANDMARK INVESTIGATION has found that there is no lawful basis for a person to be required to get a Public Services Card (PSC) for anything other than social welfare payments and benefits. 

The results of the long-awaited probe into the legality of the controversial PSC by the Data Protection Commissioner were sent to the Department of Employment Affairs and Social Protection this week.

The report outlines how there is no lawful basis for any department, except for the Department of Social Protection, for insisting a client obtain a PSC to use or access a public service. It also found that the Department of Social Protection has no legal right to retain supporting documents, such as utility bills, collected during the PSC registration process. And it criticised the department for not being sufficiently transparent in terms of the personal data it has processed in relation to the PSC.

Data Protection Commissioner Helen Dixon told TheJournal.ie: “The headline findings of the investigation is that public sector bodies other than the department itself cannot compel individuals to attend Safe-2 registration at the Department of Employment Affairs and Social Protection, and cannot require individuals who don’t have a Public Services Card to procure one for the purposes of engaging in a service with them.”

The Public Services Card was first introduced back in 2011 – when 4,000 cards were issued in a pilot project. By 2019, over 3 million of them had been created. 

The government said the card would increase efficiency in delivering public services, and help to tackle social welfare fraud. Originally required for just social welfare payments – such as carer’s allowance, State pension or jobseekers’ allowance – over the years this expanded and it was made a requirement for obtaining a driver’s licence and a passport.

A draft of the report was furnished to the department in August last year but its content was not made public. Last November, the department replied with a submission that was “several hundred pages long”, addressing that draft report.

A Freedom of Information request submitted by the Irish Council for Civil Liberties for a copy of the draft report was earlier refused because it “may be contrary to public interest”.

TheJournal.ie reported in June that the report was at an advanced stage and can confirm today that it has been completed and sent to the department. 

Dixon said that there “isn’t a significant difference” in the main findings in the original draft report and the findings in the finalised report that has now been sent to the department. 

Main findings

Sample PSC

The investigation from the Data Protection Commissioner into the legality of the Public Services Card has made three main findings.

Firstly, there is no lawful basis for the Department of Social Protection to rely on the Safe 2-register (the process used to verify someone’s identity and issue them with a PSC), and subsequently issue cards to people who need the card for anything other than dealing with this specific department.

Put plainly, there’s a basis in law for the Department of Social Protection to tell a citizen to get a PSC so they can obtain a social welfare payment, according to Dixon.

But there is no legal basis for anybody to be told to go get a Public Services Card in order to access other public services, for example, a passport or a driving licence. It should not be mandatory or compulsory to avail of any other public service. 

The Data Protection Commissioner has found that no other body – apart from the Department of Social Protection – can insist that a client obtain a Public Services Card to use or access a service.

Secondly, the department has no lawful basis for retaining all of the supporting documentation it collects after it has verified a person’s identity through its Safe process and issued a Public Services Card.

Dixon said that its investigation has found that supplementary documents a person provides to get a PSC, such as a utility bill or an official letter, is retained indefinitely by the department. So far, 3.2 million cards have been issued. 

“We fail to see what the requirement and necessity is to retain the documentation once the identity has been authenticated,” Dixon said. 

Thirdly, the Data Protection Commissioner has found the department hasn’t been sufficiently transparent in terms of the personal data it processes in the context of the PSC.

“The department has suggested that the benefits of the public services card are to simplify identify registration processes for individuals when they engage with the range of public sector bodies, and to reduce the need for them to engage in duplicate registration processes where they have to bring the same supporting documentation.

And they say it’s a benefit to the public because it enables them to access services and facilitates them in accessing [them]. What we found in reality is that not all of that is born out in practice.

Dixon added there wasn’t a “particular logic” in the need to have a PSC to access some services, citing a plan from the department to make it a requirement if a person is making an appeal about school transport decisions. 

“And so we simply don’t think there is a coherent and clear picture presented to the public in relation to why this is required,” she said.

For the second and third findings, the commissioner has requested an implementation plan for corrective action from the department within the next six weeks. 

‘Expanding functions’

Prior to controversies around the card in recent years, the government had plans to expand the range of services for which the card would be compulsory. These proposals will have to be curtailed because of the results of the Data Protection Commissioner’s probe.

The spotlight was put firmly on the Public Services Card back in 2017, when the Irish Times reported that a woman had her pension cut because she refused to get a card.

Over the past three years, TheJournal.ie has also highlighted other cases such as when a woman was asked for an adoption cert when applying for a PSC; another where a woman was asked how long she’d been living with her partner when applying for one; and people even being denied one because they were adopted.

This swell of problems was happening as the Data Protection Commissioner began a probe into the card’s legality in late-2017.

Minister Paschal Donohoe posing with a card back in 2016 Source: Leah Farrell/Rollingnews.ie

Elsewhere, there has already been a u-turn on the need for a PSC for driving licences, after pressure over the legality and reasoning for the Road Safety Authority to require the card as proof of identity. TheJournal.ie reported that at least €2 million was ploughed into the PSC/driving licence project, before Shane Ross pulled the plug last year. 

The Data Protection Commissioner also noted that the original use of the card has been joined by other potential purposes, including using it as photo ID. 

Indeed, draft legislation from the government before the Dáil would mean the PSC could be used as a de-facto age card when purchasing alcohol. 

While Dixon noted such developments may appear benign, the Commissioner also expressed concern that allowing it to be accepted to confirm age by private entities would be a “very, very big step”. 

So what does this mean?

Essentially, the Data Protection Commissioner is now saying that the department has to stop all mandatory PSC registrations, except in cases where someone is seeking one for social welfare claims or benefits.

The department will also be required to delete all of the supporting documentation that it previously collected as part of the PSC application process.

The commissioner will also ask the department to address the deficits in how it has communicated to the public on this matter. 

In August 2017, for example, Minister for Social Protection Regina Doherty made headlines when she told Newstalk Breakfast that the card is “mandatory” but not “compulsory”. 

It should be noted that the findings of this report do not impact anyone who has been issued a PSC card for the purposes of a social welfare payment, or anyone who uses their card for free travel, Dixon said. 

However, in cases where having a Public Services Card is mandatory to access a service other than those offered by the Department of Social Protection, that will now have to change.

For example, for an adult applying for a passport for the first time, the current policy of the Department of Foreign Affairs is that they need to have a Public Services Card.

Since that provision has been found to have no lawful basis, it will need to be amended. 

Dixon said this should happen immediately and has asked the Department of Social Protection to come back to her with a progress report within 21 days. 

Any services that required citizens to sign up for an online MyGovID – for which a PSC is required to sign up – will also have to amend their procedures to accept other valid forms of identification. 

Further progress on a separate part of the Commissioner’s probe into the Public Services Card, concerning MyGovID and other matters, remains ongoing.

The Irish Council for Civil Liberties, which has constantly raised concerns about the PSC, said that it welcomed the report from the Data Protection Commissioner.

It also said that it welcomed confirmation from the Department that they will publish the full report at the DPC’s direction within seven days. Its information rights manager Elizabeth Farries said:

The Minister for Social Protection has previously stated in the Oireachtas that either the Department or the DPC would release the report following this investigation. This moment has arrived, and we look forward to full disclosure from the Department.

The report is now with the Department of Employment Affairs and Social Protection. Dixon added that there’s a “real public interest” in publishing it in full. 

With reporting from Cianan Brennan