Go to Top

Reply from Data Protection Commissioner on Irish Water

Reply today from office of Data Protection Commissioner in response to complaint I made about the possible use by Irish Water of data collected and held by them:

 

Dear Deputy Shortall,

I have been asked by the Commissioner Helen Dixon to respond to you on her
behalf.

Thank you for your query in relation to concerns you are hearing about
Irish Water’s proposed collection and use of personal data. This Office is
concerned to ensure there is clarity on these matters for the 2.2 million
prospective customers of Irish Water. Clearly, the obligations under the
Data Protection Acts in this regard fall directly on Irish Water as the
Data Controller in terms of ensuring they are collecting data in a lawful
way and using it for a legitimate stated purpose which they make clear to users of their service. Notwithstanding the obligation on Irish Water, this
Office is in on-going contact with them in an effort to ensure they take on
board our best-practice advice in this regard.

The collection of the PPSN for use by Irish Water in verifying occupants of
a household is provided for in legislation. We are satisfied from this
Office’s interactions with Irish Water that it is intended to use the PPSN
for the sole purpose of confirming the qualification for a free water
allowance of occupants of the household (including children) and in line
with conditions set down for its use by the Department of Social
Protection. However, we are in agreement that the Data Protection Notice
published does not currently give sufficient clarity and detail in this
regard and we are corresponding with Irish Water and providing our views on
this.

The issue of disclosure of personal data to third parties inevitably arises
in the case of Irish Water where they are already using contractors to fit
water metres and for other outsourced functions. This Office has asked
Irish Water to be transparent in terms of making clear the categories of
the data processors to whom they are providing the data and for what
purpose and to provide contact details in the event that a customer wishes
to raise a data protection concern. We are currently following up with
Irish Water on this matter.

Equally, Irish Water as part of their business model may use outsourced
service providers outside of the EEA. We are not aware that this is
currently part of their actual business plan but it would appear to be the
case that they wish to ensure this eventuality is covered in their Data
Protection Notice. Again, we have asked them to be more explicitly clear in
the notice in relation to how they would protect the data and to identify
where possible what type of data and for what purpose a transfer would
occur.

I hope this information is of use to you. We do understand the urgency of
the matter in light of the obligation on customers to return application
forms to Irish Water and we are communicating our views in relation to this
urgency to Irish Water.

Yours sincerely,

John O’Dwyer
Deputy Data Protection Commissioner