As at 31st December 2019, the DPC had 70 statutory inquiries on hand, including 18 domestic statutory inquiries; and 21 cross-border inquiries into global technical firms, namely Facebook, WhatsApp, Instagram, Twitter, LinkedIn and Google. These open inquiries date from the 25th May 2018 to 31st December 2019.
One of the cross-border inquiries which relates to Facebook, Max Schrems and the DPC has been going on now for 7 years and the CJEU just issued a ruling on 16th July 2020. On the 9th September the DPC issued a preliminary order on Facebook to cease transferring personal data to the United States. However, Facebook have since launched a High Court challenge to the order asking the High Court to quash the order on several grounds, including alleged failure by the DPC to conduct an inquiry before it reached its decision. The matter will be before the court again in November. (For more in-depth information regarding the Schrems II ruling and its consequences see the white paper under the EU-USA Data Transfer heading)
While convictions have appeared slow to get started, these international companies have extensive resources at their disposal and it would appear that the DPC are trying to ensure that any fines issued are watertight to prevent prolonged judicial proceedings and further appeals occurring.
One of the domestic statutory investigations relates to the Public Service Card which is issued by the Department of Employment and Social Protection (DEASP). As a result of the PSC scheme and the DPC’s investigation which commenced in October 2017, pre-dated the 25th May 2018, the date the GDPR came into effect the DPC’s findings were made by reference to particular obligations imposed on controllers under the Data Protection Acts, 1988 and 2003 rather than the GDPR. This is specifically mandated by the Data Protection Act 2018 which was introduced in 2018 to facilitate the application of particular elements of the GDPR at national level.
The DPC’s statement focuses on its findings of non-compliance of the PSC scheme with data protection law in two key areas:
- The legal basis on which the personal data of individuals is processed, for example the DEASP can still require a person to obtain a PSC card to obtain social welfare payments, there is no legal basis for a person to obtain one to apply for a passport.
- The transparency of the information provided to individuals on the processing of their personal data was not adequate and that the Department is retaining the personal data of PSC card applicants for longer that is necessary. For example, keeping photocopies of utility bills that individuals provided as proof of address.
The DPC report called on DEASP to develop and submit its implementation plan within a period of 6 weeks, and to ensure that the measures necessary to bring the scheme into compliance would be in place no later than 31 December 2019.
The DPC also called on DEASP to take two specific steps within a period of 21 days:
- Cease all processing of personal data carried out in connection with the issuing of PSCs, where a PSC is issued solely for the purpose of a transaction between a member of the public and a specified public body (i.e. a public body other than DEASP itself).
- Notify all public bodies who require production of a PSC as a pre-condition to entering into a transaction with (or providing a public service to) a member of the public that, going forward, DEASP would not be in a position to issue PSCs to such persons.
Correspondence issues between the DPC and DEASP which concluded in the DPC issuing a letter noting that, since DEASP was refusing to accept the report’s findings, and where it was clear that no implementation plan would be formulated or implemented by DEASP to address the points of non-compliance identified within those findings, the basis on which the DPC had deferred enforcement action no longer applied
Ultimately an enforcement notice was issued under Section 10 of the Data Protection Acts 1988 and 2003 on 6 December 2019. That notice, which was directed to the Minister (acting through DEASP), directs the taking of a range of steps in order to remedy the contraventions identified in the DPC’s report.
The enforcement notice has since been appealed by the Minister to the Circuit Court. It is expected that the appeal will be heard at some point during 2020.
Further updates to follow once the appeal has been heard.