A Department of Health whistleblower has welcomed a Data Protection Commissioner (DPC) decision to issue a fine and ban the practice of collecting excessive sensitive information on children with autism who took legal cases against the State.
Shane Corr raised concerns within the Department in 2020 when he discovered he had access to extremely sensitive files on children and families who took High Court cases to secure their right to special needs educational services.
In a subsequent RTÉ Investigates report broadcast in March 2021 it emerged that in preparing High Court defences against these long-running cases the Department had sought information from co-defendants such as the Health Service Executive (HSE).
During periodic communications, broad questions from the Department elicited replies on sensitive personal matters, which were gathered and retained.
These included details of private family records, insights on the martial situation of parents and even details of a confidential doctor's consultation.
In her decision on Monday, the Data Protection Commissioner, Helen Dixon, fined the Department €22,500, she reprimanded it for its behaviour, and banned it from continuing the practice.
In a statement to RTÉ Investigates, Mr Corr welcomed the development.
"The decision from the DPC is very welcome. The Department of Health secretly gathered sensitive information on the most vulnerable children and their families. It was wrong then and it is wrong now."
"In this case the Department tried to get me to sign a non-disclosure agreement. The right to know must be accompanied with a right to tell, and such gagging practices must cease," he said.
The ruling follows a two-year inquiry by the DPC, which included unprecedented searches of the Department’s headquarters over a three-month period.
Ms Dixon found the Department did not have a lawful basis for processing information on individuals and families who took the cases against it.
"The DPC found that the Department did infringe data protection law by asking broad questions that resulted in the provision of sensitive information about the private lives of plaintiffs and their families," the summary statement from the DPC said.
"This information included details about plaintiff’s jobs and living circumstances, information about their parents’ marital difficulties and in one case, information received directly from a doctor about the services that were being provided to the plaintiff."
When the allegations were first aired by Mr Corr in 2020, the Department of Health appointed a Special Counsel to the investigate the matter. In a statement following the RTÉ Investigates broadcast in March 2021, the Department said the subsequent report had vindicated its approach.
Following the RTÉ Investigates report, the Secretary General of the Department, Robert Watt, commissioned a second internal report which was delivered to him in April 2021.
It too found no fault in the Department’s actions and said that "having reviewed the relevant files, there is no evidence that the Department of Health gathered information that was beyond instructions as part of the normal defence of a litigation case."
On foot of those internal reviews, Mr Watt staunchly defended the Department’s approach, saying the RTÉ Investigates report did not "stand up."
"There is no evidence that the Department was secretly compiling documents on children with autism involved in special education needs litigation, as alleged," he told the Oireachtas Joint Committee on Health in May 2021.
However, in response to the DPC’s new findings the Department said it accepted that it had infringed on the rights of people when it received and processed excessive information on plaintiffs which it had sought from the HSE.
It said it had accepted a ban imposed by the DPC on the processing of personal data in the special educational needs litigation cases "which has been confirmed as being neither necessary nor proportional for the purposes under which it was obtained."
The Department also accepted that until the whistleblower’s disclosures staff with no legitimate or business need had access to the sensitive material on the children and families who had taken cases.
In response to the publication of the report, Social Democrats health spokesperson Roisin Shortall called for the Department to review its procedures relating to sensitive data.
"I welcome the decision that the Department of Health was in breach of data protection law in respect of seeking sensitive and confidential information regarding persons with special needs and their families as part of a legal strategy."
"This had been firmly denied by the Department of Health when RTÉ investigates broke the story," she said.
"We now have clarity, and the imposition of a fine on the Department of Health. Clearly new protocols and procedures will need to be put in place to ensure that these breaches never happen again."
Meanwhile, Sinn Féin’s health spokesperson David Cullinane called on the Department to "accept these findings in full and take immediate steps to implement the recommendations."
