Data Protection Commissioner finds POD was, and still is, unlawful

The Data Protection Commissioner’s Office today confirmed that, having investigated the Primary Online Database, they found that parental concerns raised were valid and that, even following changes to the scheme in April, the POD would require further legislation to be lawful. 

Unless that legislation is introduced, schools transferring the requested pupils data to the Departmemt of Education will not have the nessecary lawful basis to do so.

The Primary Online Database is the Department of Education and Skills’ project to create a centralised database on all the country’s children.

It was originally grounded on a Departmental Circular of Jan 2014.

Following parental questioning of the legality of the scheme, the Minister for Education strongly defended it, saying 

“I have gone back and asked for the reasons why it’s up to the 30th birthday and I am told it is in order to ensure that we have full maximum data that we need.”

“I did say I would examine it but it looks to me that up to the 30th birthday is probably appropriate and it satisfies the Data Commissioner as well which is obviously very important,” she added.

Despite these assertions, the retention period for children’s data was reduced until they turned 19 and other changes made piecemeal before the whole Circular was scrapped and replaced with a second scheme based on a new Circular- which is still not lawful. 

You can see rather nice visual history to this retreat here.

A senior official in the Data Protection Commissioner’s office today confirmed that the legislation the Department of Education had relied upon to justify the legality of transferring data from schools to the Department did not cover most of the data requested.

a number of POD fields are not listed in Regulation 189 and, as such, they do not constitute “prescribed” information for the purposes of Section 266 of the 2005 Act.
 The data fields concerned are as follows: Mother’s Maiden Name; Enrolment Date; Enrolment Source; Leaving Date; Leaving Destination; Integrated Indicator; Indicator for Receipt of Learning Support; Pupil Type and Special Class Type. We consider that an amending statutory instrument should have been signed before these data fields were included in POD. 

The full text of the email from the senior official in the Data Protection Commissioner’s office is below.
***

 Dear Mr McGarr

I refer to your previous correspondence to this Office concerning the Primary Online Database (POD).

As you know, we opened an investigation in relation to the POD in accordance with Section 10(1)(a) of the Data Protection Acts, 1988 & 2003.
The investigation involved extensive contact with the relevant officials in the Department of Education and Skills including written communications, conference calls and meetings. The Department cooperated fully with our investigation. I am now writing to advise you of the outcome of that investigation.

The aim of our investigation has been to establish whether the POD and its implementation is in compliance with the Data Protection Acts, 1988 & 2003. In that regard, we identified a number of deficiencies which have been the focus of directions on our part to the Department of Education and Skills over the last number of months. Some of the areas where we identified issues corresponded with issues referred to in complaints received from you and from other parents.

Retention Period and Fair Processing Notice

The retention age for pupil data in the POD was set at 30 years of age. Following the intervention of this Office in which we drew the Department’s attention to the valid concerns raised by you and other parents, the retention period has now been revised downwards to the pupil’s 19th birthday. In a further corrective action, the Department of Education revised its original “Fair Processing Notice” and it published its revised notice in April 2015 – which gives more detailed information to explain how the personal data of pupils on the POD will be processed. The revised “Fair Processing Notice” also indicates that some changes have been made by the Department to the original list of data fields referred to in the previous notice.
PPSN

The collection and sharing of PPSN data was raised as a matter of concern by you and some other parents. This Office is satisfied that, in principle, the collection and sharing of PPSN data between schools and the Department of Education and Skills for the purposes of the POD, and the subsequent use of PPSN numbers by the Minister for Education in the discharge of his/her statutory functions can lawfully be undertaken. Under Section 262(4) of the Social Welfare Consolidation Act, 2005 (“the 2005 Act”) a specified body may require access to an individual’s PPSN in any case where (a) the individual in question is entering into a “transaction” with the specified body; and (b) the specified body requires the individual’s PPSN number for the purposes of that transaction. The Minister for Education is a “specified body” for the purposes of Section 262(4). Transaction in this context is defined to included “a supply of a service relating to a public function of a specified body which relates to a natural person.” The provision of primary education to children resident in the State, delivered through a network of recognised schools necessarily involves the supply of a service by the Minister to natural persons relating to a public function of the Minister.

 It is also the case that all children have a right to free primary education under Article 42.4 of the Constitution. That right is also the subject of primary legislation. In particular, the Education Act, 1998 expressly provides that it shall be a function of the Minister for Education that he/she shall ensure that there is made available to each person resident in the State a level and quality of education appropriate to meeting the needs and abilities of that person.

Moreover, we are satisfied that Section 262(6)(b) of the 2005 Act authorises the Minister for Education and Skills to use pupils’ PPSN numbers in performing his/her public functions as those functions relate to pupils.
The Minister’s functions also include the following:

• to plan and coordinate the provision of education in recognised schools and centres for education.
• to provide funding to each recognised school and centre for education
• and to provide support services to recognised schools and centres for education
•  to monitor and assess the quality, economy, efficiency and effectiveness of the education system provided in the State by recognised schools and centres for education.

Legal Basis for Sharing of Data

With regard to the sharing of broader categories of personal data, it is worth noting that the 2005 Act authorises a “specified body” to share “prescribed” information with the Minister for Education and Skills. This is achieved by Section 266 of the 2005 Act and a list of “specified bodies” is contained in Schedule 5 of the Act. This list includes any recognised school or centre for education within the meaning of Section 2 of the Education Act, 1998. It follows that any primary school that is a “recognised school” for the purposes of Section 2 of the Education Act, 1998 is constituted as a “specified body” for the purpose of Section 266 of the Social Welfare Consolidation Act, 2005 and may share “prescribed” information with the Minister for Education. The nature and extent of the “prescribed” information that may be passed by a specified body to the Minister under Section 266 of the 2005 Act is defined in the Social Welfare (Consolidated Claims, Payments and Control) Regulations, 2007 (SI 142/2007). Specifically therein Regulation 189 prescribes a whole range of data fields such as name, address, date of birth, PPSN, roll number, class group and year, special needs, etc. All of the prescribed information listed in Regulation 189 is relevant to the operation of the POD – i.e. POD requires each primary school to enter data into the database by reference to all of the data fields identified in Regulation 189. We are satisfied, in principle, that those data fields that are required for the purposes of POD and are listed in Regulation 189 can lawfully be shared by schools with the Department of Education and Skills.

However, a number of POD fields are not listed in Regulation 189 and, as such, they do not constitute “prescribed” information for the purposes of
Section 266 of the 2005 Act. The data fields concerned are as follows: Mother’s Maiden Name; Enrolment Date; Enrolment Source; Leaving Date; Leaving Destination; Integrated Indicator; Indicator for Receipt of Learning Support; Pupil Type and Special Class Type. We consider that an amending statutory instrument should have been signed before these data fields were included in POD. Having identified this deficiency in the legitimising of the processing, we directed the Department of Education and Skills to have an amending statutory instrument introduced.

The statutory instrument concerned is one which falls under the remit of the Minister for Social Protection. Having conveyed our direction on this particular issue to the Department of Education and Skills, it has informed us that it has raised the matter with the Department of Social Protection and that they have jointly agreed to work towards introducing an amending statutory instrument as soon as possible. We will, of course, continue to monitor progress on this matter and we will take whatever actions we deem necessary if this matter is not progressed to finality within a reasonable timeframe.

Register of Users of PPSN

You also raised concerns that the Register of Users of PPSN numbers published on the website of the Department of Social Protection does not include the use of PPSN data for the purposes of POD. Corrective action has also been taken on that matter. The entry for the Department of Education and Skills on that Register now shows at No. 5 that the Department uses the PPSN number as a unique identifier for all pupils entered on the POD.
Conclusion

In conclusion, then, a number of deficiencies in the implementation of this project were identified. I am satisfied that on foot of directions from this Office, the Department of Education and Skills has taken or is in the process of taking corrective action in relation to these deficiencies.
Yours sincerely 

XXXX XXXX

Senior Investigations Officer
17/06/2015
[This email is not a legal notice or a decision of the Data Protection

Commissioner to which Section 26 of the Data Protection Acts, 1988 & 2003

applies].

ENCLOSURES:

————————————————————————————————————————————————————

An Coimisinéir Cosanta Sonraí

Teach na Canálach

Bóthar an Stáisiúin

Cúil an tSúdaire

Co. Laoise

Office of the Data Protection Commissioner