Read on Twitter
Hello and welcome to my PSC thread entitled
“I told ye so, so I did.”
“I told ye so, so I did.”
Here is the Irish Times report on that bombshell #PSC set of findings by the DPC https://www.irishtimes.com/news/ireland/irish-news/irish-state-told-to-delete-unlawful-data-on-3-2m-citizens-1.3987606
Here is the report from The Journal too. https://twitter.com/thejournal_ie/status/1162137643183816704?s=21
Here is my post from August 2017 demonstrating the #PSC project lacked a legal basis. https://www.mcgarrsolicitors.ie/2017/08/23/public-services-card-id-database-id-card/amp/
Here is the DPC becoming vocally concerned Aug 2017 a day after I went on Morning Ireland and explained the #PSC project didn’t have a legal basis.
Also, the same report contains some guff from the Minister which we can now safely discount. https://www.rte.ie/news/2017/0830/900960-public-services-card/
Also, the same report contains some guff from the Minister which we can now safely discount. https://www.rte.ie/news/2017/0830/900960-public-services-card/
Here I am, with the late Noel Whelan and @ciananbrennan in Sept 2017, expanding on why the PSC Card represented a crisis of wilful data mis-management for the Irish State. https://www.thejournal.ie/facebook-live-public-services-card-2-3583238-Sep2017/?utm_source=facebook_short
Here is the written submission I made to the Oireachtas Committee overseeing the @Welfare_ie #PSC project in Feb 2018.
https://data.oireachtas.ie/ie/oireachtas/committee/dail/32/joint_committee_on_employment_affairs_and_social_protection/submissions/2018/2018-02-08_opening-statement-simon-mcgarr-mcgarr-solicitors_en.pdf
https://data.oireachtas.ie/ie/oireachtas/committee/dail/32/joint_committee_on_employment_affairs_and_social_protection/submissions/2018/2018-02-08_opening-statement-simon-mcgarr-mcgarr-solicitors_en.pdf
Here is the Feb 2018 appearance I made, alongside @tjmcintyre and the stalwarts from the @ICCLtweet , @liamherrick and @maeveorourke , before the Committee to answer their questions on the #PSC project.
https://www.kildarestreet.com/committees/?id=2018-02-08a.1039
https://www.kildarestreet.com/committees/?id=2018-02-08a.1039
This was shortly after I had the uncomfortable experience of having to explain how laws worked- as a concept- to a serving minister on live TV, to counter a suggestion that Facebook should be also be given access to the #PSC database. https://www.digitalrights.ie/taoiseach-rejects-linking-public-services-card-social-media/
But shortly before I had the experience of having a Government Department being specifically wrong about their own rules in response to me.
https://www.irishmirror.ie/news/irish-news/public-services-card-ireland-privacy-11994665
https://www.irishmirror.ie/news/irish-news/public-services-card-ireland-privacy-11994665
By Sept 2018, The DPC investigation is not going well for the Dept @welfare_ie. The Dept (and the other Dept which controls the #PSC project, the Dept Public Expenditure and Reform) respond by accelerating the unlawful data sharing.
https://www.gov.ie/en/organisation/department-of-public-expenditure-and-reform/
https://www.gov.ie/en/organisation/department-of-public-expenditure-and-reform/
In Sept 2018, I go on Morning Ireland again to further explain what any lawyer will now openly say- the #PSC shared database project lacks a lawful basis. https://twitter.com/tupp_ed/status/1036322638401032192?s=21
By Jan 2019, it was very clear what the level of risk the the Joint Controllers of the #PSC project had voluntarily assumed on taxpayer’s behalf.
So I tried to warn about that too.
#PSC https://www.thejournal.ie/readme/opinion-if-the-public-services-card-is-found-to-be-unlawful-it-could-be-the-most-expensive-administrative-error-in-the-history-of-the-state-4446879-Jan2019/
So I tried to warn about that too.
#PSC https://www.thejournal.ie/readme/opinion-if-the-public-services-card-is-found-to-be-unlawful-it-could-be-the-most-expensive-administrative-error-in-the-history-of-the-state-4446879-Jan2019/
(Temporary pause for a small beer)
Here is a narrative I put together where I explain why the Gov’s entire approach to data sharing has been unlawful since the 2015 Bara judgement from the CJEU. https://twitter.com/i/moments/955720672612929536
Here is my post from 2015 where I explain how and why the data sharing model the #PSC project exemplified is illegal in Ireland. https://www.mcgarrsolicitors.ie/2015/11/21/misreading-bara-the-irish-states-database-crisis/?cli_action=1565920600.178
I was told that this, and my #PSC card arguments, were “mad” by a fellow-lawyer working for the state at a CPD during this time.
This is a risk of banging away at a topic. You appear to be a bit mad.
I do not think I am mad.
This is a risk of banging away at a topic. You appear to be a bit mad.
I do not think I am mad.
However, I did discover, while making an unrelated FOI request, that the Dept @welfare_ie, at some stage started recording my tweets and media appearances, and circulating them to management for annotation.
This was... a strange use of public servant time?
This was... a strange use of public servant time?
Here, the Principle Officer in the section responsible for the #PSC circulates his thoughts on my latest utterances to nine other senior managers, including the Sec-Gen.
“Simon McGarr is getting desperate...”
“Simon McGarr is getting desperate...”
One of those on this fan club email was made the new DPO for @welfare_ie after the serving DPO was removed while the Dept was being investigated for interfering with the old DPO’s independence.
During this time two organisations kept plugging away on expanding and amplifying the critique of the #PSC
@DRIalerts and @ICCLtweet worked together to explain what was happening to the wider public.
@DRIalerts and @ICCLtweet worked together to explain what was happening to the wider public.
And the same few journalists produced story after story on the #PSC.
But one person made more of an impact on bringing this story to the wider public and turning it into a debate.
This lady here:
https://www.irishtimes.com/news/social-affairs/woman-s-pension-cut-after-she-refuses-to-get-public-services-card-1.3194216?mode=amp
But one person made more of an impact on bringing this story to the wider public and turning it into a debate.
This lady here:
https://www.irishtimes.com/news/social-affairs/woman-s-pension-cut-after-she-refuses-to-get-public-services-card-1.3194216?mode=amp
This lady suffered personal financial consequences for her insistence on a simple answer. She would get a #PSC if she could be shown where, in law, it said she had to have one.
The @welfare_ie cut off her pension rather than answer it.
The @welfare_ie cut off her pension rather than answer it.
It wasn’t until @ElaineEdwards told her story that the mood shifted- because, while privacy rights feel like quite an abstract issue, a pensioner being bullied by the state brought it all into perspective.
Here’s a thread setting out where things stood in Sept 2018.
Note that the impetus for the extension of data sharing through the public service hasn’t come from Welfare, but from DPER.
(Dept Public aexpenditure and Reform)
Their Data Sharing Act is dead https://twitter.com/tupp_ed/status/1041449578019606528?s=21
Note that the impetus for the extension of data sharing through the public service hasn’t come from Welfare, but from DPER.
(Dept Public aexpenditure and Reform)
Their Data Sharing Act is dead https://twitter.com/tupp_ed/status/1041449578019606528?s=21
One of the fun parts of this thread is knowing just how closely the Dept officials follow my tweets. Presumably, they're all getting a breathless email like this tomorrow.
"Simon McGarr just sent a 'thank you reply"
"Simon McGarr just sent a 'thank you reply"
I ended up with Documents that showed the Sec-Gen had interfered with his independent DPO’s intention to make clear in the Departmental Privacy Notice that the Dept processes biometric data.
I got them via FOI.
I got them via FOI.
No other FOI I have ever made since that to @welfare_ie has resulted in a single document being released to me.
One official told me after that they couldn’t be seen to have helped me. I pointed out there was a statutory duty to help me in the FOI act.
They fell silent.
One official told me after that they couldn’t be seen to have helped me. I pointed out there was a statutory duty to help me in the FOI act.
They fell silent.
Catherine Murphy tried to get the Minister to face up to the discrepancies in her various statements on her Dept’s use of Biometric data.
I’m going to show you a video. I... don’t think the Minister comes out we’ll. https://twitter.com/tupp_ed/status/992115922109370368?s=21
I’m going to show you a video. I... don’t think the Minister comes out we’ll. https://twitter.com/tupp_ed/status/992115922109370368?s=21
Here I am on @drivetimerte explaining why talk of salvaging the #PSC project ignores the legal reality that EU law is superior to any national provision the Gov may dream
I also point out that DPER is the joint controller of the PSC database.
From 17:20 https://www.rte.ie/radio/utils/share/radio1/11077024
I also point out that DPER is the joint controller of the PSC database.
From 17:20 https://www.rte.ie/radio/utils/share/radio1/11077024
And then the points were put directly to the Minister in charge in DPER, Paschal Donoghue who was on after me.
From 50.10 in. https://www.rte.ie/radio/utils/share/radio1/11077024
From 50.10 in. https://www.rte.ie/radio/utils/share/radio1/11077024
The Minister, eh, perhaps was not expecting to be asked to account for his role- all the attention had been on Ms Doherty all day.
However he said a sequence of interesting things, so we should be grateful to @drivetimerte for taking the opportunity that presented itself.
However he said a sequence of interesting things, so we should be grateful to @drivetimerte for taking the opportunity that presented itself.
Two points:
1) DEPR knew DEASP had got a copy of the draft DPC report last year but in all that time never asked to see it. Despite being jointly liable for the project.
2) Pressed, Minister Donoghue said that, as he sat there now, he thought he’d accept the report.
1) DEPR knew DEASP had got a copy of the draft DPC report last year but in all that time never asked to see it. Despite being jointly liable for the project.
2) Pressed, Minister Donoghue said that, as he sat there now, he thought he’d accept the report.
When I say that DPER are jointly liable, I mean they are joint controllers. Not only that, but, per the recent Fashion ID CJEU case, Minister Donoghue is the data controller whose actions were most condemned by the DPC.
Here’s an extract from the Data Processing Agreement.
Here’s an extract from the Data Processing Agreement.
As you can see, @Welfare_ie is collecting the data *for* the DPER database.
The PSC project has always been a DPER project, implemented by Welfare- as the Dept with the most leverage
The PSC project has always been a DPER project, implemented by Welfare- as the Dept with the most leverage
The most recent version of that agreement was signed in Dec 2017, after the DPC investigation commenced. Meaning that the Joint Controller relationship it describes was the relevant one for the period of the report.
We haven’t heard if @DPCIreland delivered a report copy to DPER
We haven’t heard if @DPCIreland delivered a report copy to DPER
We’ve been hearing from the Gov side some fresh new talking points where they take the position that they may be fools whose intentions were good and they invite us to consider their intentions not their actions.
This is the sort of thing that indicates to me that nobody on the State side has any idea how to explain what they have done.
What they have done is to breach the rights of millions of people in the teeth of years of warning that what they were doing was illegal.
What they have done is to breach the rights of millions of people in the teeth of years of warning that what they were doing was illegal.
When Elaine Edwards reported on the challenge that the Bara judgment represented to the state’s data sharing plans the SecGen of DPER wrote a Letter to the Editor, completely rejecting any suggestion that his Dept may need to rethink its approach.
https://www.irishtimes.com/opinion/letters/sharing-data-and-the-rights-of-citizens-1.2911938
https://www.irishtimes.com/opinion/letters/sharing-data-and-the-rights-of-citizens-1.2911938
I could tweet the whole letter out, but let’s just say there can be few dismissive missives which match it for failing to stand the test of time.
2016, remember. DPER’s SecGen simply denied the (completely accurate) warnings available.
2016, remember. DPER’s SecGen simply denied the (completely accurate) warnings available.
The Taoiseach has now come out on the PSC.
Behind the guffery about fraud (still!) he seems to be accepting the end of the DPER data sharing project, limiting his examples of future use to Social Welfare uses. https://www.independent.ie/irish-news/news/dont-throw-away-your-public-service-cards-warns-taoiseach-leo-varadkar-as-he-pledges-greater-transparency-38412035.html
Behind the guffery about fraud (still!) he seems to be accepting the end of the DPER data sharing project, limiting his examples of future use to Social Welfare uses. https://www.independent.ie/irish-news/news/dont-throw-away-your-public-service-cards-warns-taoiseach-leo-varadkar-as-he-pledges-greater-transparency-38412035.html
It is, in fact Govt policy right now.
As anyone trying to get their first passport, driving licence etc will confirm.
It has no legal basis.
That is what the 172 page report from the DPC is about.
As anyone trying to get their first passport, driving licence etc will confirm.
It has no legal basis.
That is what the 172 page report from the DPC is about.
However, I think the Taoiseach’s intervention puts an end to any thought of either JR or Appeal of the DPC’s report.
It is horrifically expensive and risky to breach the GDPR rights of millions of people.
This is by design.
It is deliberately made horrifically expensive so that all the alternatives will cost less to implement.
Any Social Welfare Minister can explain incentives, right?
This is by design.
It is deliberately made horrifically expensive so that all the alternatives will cost less to implement.
Any Social Welfare Minister can explain incentives, right?
I went before the Oireachtas to sound the alarm about the #PSC cost and risk.
The Dept says the PSC has- all years to date-“contributed” to identifying between €1.7 and €2m in fraud costs.
It has cost €62m.
Savings!
https://www.thejournal.ie/public-services-card-oireachtas-committee-3840426-Feb2018/
The Dept says the PSC has- all years to date-“contributed” to identifying between €1.7 and €2m in fraud costs.
It has cost €62m.
Savings!
https://www.thejournal.ie/public-services-card-oireachtas-committee-3840426-Feb2018/
A reminder: the RSA weren’t happy about the PSC Card requirement forced on em
Then in March 2018 Shane Ross was told by the AG that the Social Welfare Act basis for requiring it wasn’t solid.
So, maybe DPER just weren’t hot on getting external AG advice.
https://www.thejournal.ie/psc-driving-licences-rsa-legal-basis-4008300-May2018/
Then in March 2018 Shane Ross was told by the AG that the Social Welfare Act basis for requiring it wasn’t solid.
So, maybe DPER just weren’t hot on getting external AG advice.
https://www.thejournal.ie/psc-driving-licences-rsa-legal-basis-4008300-May2018/
(Here’s a side thread, but interesting all the same) https://twitter.com/tupp_ed/status/1162821738608173056?s=21
And, while we’re waiting for the DPC’s report (with post-GDPR fining powers) into the Dept’s Claim their database of facial images isn’t a biometric database, here’s my report showing why it is. https://www.mcgarrsolicitors.ie/2018/07/13/the-facial-images-on-the-psc-are-biometric-data/
I was on @gavreilly’s On The Record show this afternoon, discussing the #PSC.
I suggest you listen to it from half way in, as the start has a bunch of stuff about the Dept monitoring you already know. But I think the Q at the end is key. https://www.newstalk.com/podcasts/on-the-record-with-gavan-reilly/public-services-card-unlawful-data-deleted
I suggest you listen to it from half way in, as the start has a bunch of stuff about the Dept monitoring you already know. But I think the Q at the end is key. https://www.newstalk.com/podcasts/on-the-record-with-gavan-reilly/public-services-card-unlawful-data-deleted
Shane Ross got a verbal briefing from the AG in March 2018 which prompted him to tell the RSA to cancel their plans to require the PSC.
Who else in Gov knew the requirements weren’t lawful and when did they know them?
Source: https://www.thejournal.ie/rsa-psc-online-driving-licences-spend-4021546-May2018/
Who else in Gov knew the requirements weren’t lawful and when did they know them?
Source: https://www.thejournal.ie/rsa-psc-online-driving-licences-spend-4021546-May2018/
This is, I think, probably the most familiar question in journalism.
“Who knew what, and when?”
But the answer determines the bona fides of everyone involved in the #PSC project.
“Who knew what, and when?”
But the answer determines the bona fides of everyone involved in the #PSC project.
When they say “if you’re explaining, you’re losing” I don’t think they mean you should just curl into a ball and rock as an alternative. https://extra.ie/2019/08/18/news/irish-news/doherty-public-service-card-scheme
In March 2018, Shane Ross said he’d got a verbal briefing from the AG on the PSC legal basis. He stopped the RSA from requiring it as a result.
In February 2018, Regina Doherty told the Dáil “There is no legal basis for the card”
Who else knew, and when?
https://www.kildarestreet.com/debates/?id=2018-02-20a.368#g371
In February 2018, Regina Doherty told the Dáil “There is no legal basis for the card”
Who else knew, and when?
https://www.kildarestreet.com/debates/?id=2018-02-20a.368#g371
Gov bodies are looking to @welfare_ie for advice on how to handle their PSC use.
1) It was DPER who pressured Depts to use the PCS.
2) Here’s why I think this approach both wrongheaded and risky for those bodies:
https://www.irishexaminer.com/breakingnews/ireland/public-services-card-bodies-to-discuss-how-best-to-approach-data-commissioner-advice-944884.html
1) It was DPER who pressured Depts to use the PCS.
2) Here’s why I think this approach both wrongheaded and risky for those bodies:
https://www.irishexaminer.com/breakingnews/ireland/public-services-card-bodies-to-discuss-how-best-to-approach-data-commissioner-advice-944884.html
The WRC decision simply restated a 40 year old tenet of EU law- State bodies must each take their own legal advice where there is a potential conflict between national legislation and EU law.
And then, they should just behave as though the conflicting national law didn’t exist.
And then, they should just behave as though the conflicting national law didn’t exist.
This is a fundemental challenge to Ireland’s uniquely centralised system of government. Hence, I presume, the efforts by the Depr of Justice to reverse this longstanding principle in the WRC case.
Every public body, every agency needs to build Independent EU law capacity.
Every public body, every agency needs to build Independent EU law capacity.
In Data Protection, yes, obviously, but also in planning, in regulatory affairs etc.
The revolution of EU law’s supremacy hasn’t been accepted by a centralised state, with power still treated like it is in the gift of an occupying force in Dublin Castle.
Post-colonial we remain
The revolution of EU law’s supremacy hasn’t been accepted by a centralised state, with power still treated like it is in the gift of an occupying force in Dublin Castle.
Post-colonial we remain
The reflex to turn to an exterior authority (“We’ve asked DPER/Welfare and they say it’s compliant”) is a failure of other public bodies and agencies to accept their uncomfortable duty to take responsibility for the legality of their actions.
I’ve said it already- the key question in the #PSC story now:
Who knew what, and when?
Now, contrary to what he said on Drivetime last Friday, it turns out Paschal Donoghue and his SecGen have had the draft DPC report for a year. https://twitter.com/ciananbrennan/status/1163940721851809797?s=21
Who knew what, and when?
Now, contrary to what he said on Drivetime last Friday, it turns out Paschal Donoghue and his SecGen have had the draft DPC report for a year. https://twitter.com/ciananbrennan/status/1163940721851809797?s=21
Meanwhile the Minister @welfare_ie will be hiding the DPC’s report from the public until she feels she’s got some response to it.
A full year after the draft report- with largely the same text- she can give no timeframe when that may be. https://twitter.com/ciananbrennan/status/1164517559116472323?s=21
A full year after the draft report- with largely the same text- she can give no timeframe when that may be. https://twitter.com/ciananbrennan/status/1164517559116472323?s=21
Over a decade into the project, and having cajoled and pressurised millions of people to get a #PSC the two main Depts can’t answer a simple question- are they joint controllers of the data collected? https://twitter.com/irishexaminer/status/1166201020034289665?s=21
The problem for DPER in particular is that it signed a written contract with Welfare permitting it to act as a data processor, but describing actions which are those of a joint controller.
They’re refusing to publish the DPC report and they’re going for the Appeal road.
Link to story: https://www.irishtimes.com/news/politics/government-to-challenge-order-that-public-services-card-had-no-basis-in-law-1.4005670?mode=amp
The Minister claimed the PSC report would be published.
But then her Dept revealed just how devestating the report’s findings were, and refused. https://twitter.com/tupp_ed/status/1173512546109808643?s=21
But then her Dept revealed just how devestating the report’s findings were, and refused. https://twitter.com/tupp_ed/status/1173512546109808643?s=21
The Minister explains that the legal basis for making people get a PSC card before they're allowed get a Passport is rock solid and that is why they have scrapped it entirely.
https://www.irishtimes.com/news/politics/no-great-mystery-to-decision-to-drop-psc-requirement-for-passports-t%C3%A1naiste-1.4024086
https://www.irishtimes.com/news/politics/no-great-mystery-to-decision-to-drop-psc-requirement-for-passports-t%C3%A1naiste-1.4024086
Oh hey, time to drag health record data into the database.
Even I didn’t think anyone would be dumb enough for this. https://twitter.com/seanmjourno/status/1175546497649102848?s=21
Even I didn’t think anyone would be dumb enough for this. https://twitter.com/seanmjourno/status/1175546497649102848?s=21
The DPC has started turning its attention to the Department of Children. https://twitter.com/ciananbrennan/status/1180246961028571136?s=21
And here’s the full story online, so you don’t have to squint and zoom in.
Cianan’s doing great work in the Examiner on this story. https://twitter.com/ciananbrennan/status/1180365574439919616?s=21
Cianan’s doing great work in the Examiner on this story. https://twitter.com/ciananbrennan/status/1180365574439919616?s=21
Incidentally, if you’re a Minister and your officials turn up with a giant prop of a controversial project for a photo shoot, maybe that’s a sign you are being set up to appear beside this story as it spirals down for years to come.
I’d be asking my Dept for an inventory of all projects with a giant prop associated with them and then just cancelling them all to be safe.
