Via Out-Law, the Scottish Government plans to reduce the amount of personal data it collects.

[The Government] has proposed a set of Identity Management and Privacy Principles with which public bodies will have to comply. The principles move the Scottish Government away from the trend of building very large public databases of personal information.

“Organisations should avoid creating large centralised databases of personal information and store personal and transactional data separately,” said a statement outlining the plans. “People should only be asked for identity when necessary and they should be asked for as little information as possible.”

This chimes with the requirements of the Data Protection Directive, implemented in Ireland by the Data Protection Acts 1988 and 2003. Section 2(1)(c) requires that personal data is collected only for specified, explicit and legitimate purposes. This data cannot be further processed in a manner incompatible with that stated purpose and the data must be relevant and not excessive. Neither should it be kept longer than necessary.

The new Scottish approach is in marked contrast to the data-hungry attitude of most government agencies, including our own. For example, the PPS numbering system, originally intended only for the administration of social welfare payments and tax deductions, has balooned into a general purpose citizen ID number. In the UK there has, at least, been extensive debate about the merits of a scheme of national IDs but in Ireland a de facto national ID system is creeping in around the edges.

In addition to the provisions of the Data Protection Acts, the Social Welfare Acts and the PPS code of practice published by the Department of Welfare govern the PPS system. The most important provision of the Social Welfare Acts in this regard, and one which does not appear to be widely appreciated, is section 223(6), which states that it is an offence to use or request a PPS number from someone unless specifically entitled to do so (e.g. by being a State agency named in the Acts). Nevertheless, it is routinely sought by private sector entities and professionals without specific thought as to whether the number is required in the transaction. State agencies appear to be satisfied that they are entitled to seek PPS numbers if they are listed in the Social Welfare Acts, regardless of the implications of the Data Protection Acts.

The gradual extension of the PPS system allows for the collation of vast amounts of data by Irish government agencies. Irish politicians should adopt the Scottish approach and decide that a positive policy should be implemented which ensures that agencies request information only when it is both relevant and necessary.

• Uncategorized