When a whistleblower went public more than two years ago to reveal controversial information gathering techniques within the Department of Health – one family in the southwest felt worried.
"I knew instantly when I looked and watched it, I was like, 'oh, my God, the majority of that's about us,'" said Sharon Keogh.
It was an instinctive reaction based on the knowledge that in 2007 she had taken a High Court case against the State with the sole purpose of getting proper primary school education for her son Adam who had been diagnosed with autism.
Legally the case was dormant but in her mind it was dead – the claim had been to secure sufficient special needs support for her son Adam in primary school. He was long finished primary school and so there was no point to reactivating the action.
"When I spoke to solicitor back in could have been 2007, 2008 maybe, I can't remember the exact dates, but I wasn't going any further with that case. I was told afterwards it was called a dormant case, but to me it was done, it was dusted, I had no more to do with it. I never thought about it again.
"I told them I was getting enough services from my son at the time and I just wasn't willing to fight anymore. I had enough other fights on my hand without dealing with a High Court as well," she said.
However, for the Department there was still one loose end. Even though the case had never progressed, it had not been formally closed so there was still a potential issue of costs.
For this reason, the case was still being monitored by departmental staff and, as part of its litigation strategy, there were dossiers kept on the families involved.
It was the contents of these files that disturbed civil servant, Shane Corr, so much that he made a protected disclosure in 2020.
Read: Family at centre of dossier scandal seek Dept of Health apology
His concern was that highly confidential details on the litigants had been shared between the likes of the HSE and the Department of Health to weigh up if it might be an appropriate time to approach the families to settle. This included highly sensitive and confidential data on the health and personal circumstances of litigants.
His disclosure was examined by a senior counsel appointed by the Department but it did not bring about an end to the behaviour – it had looked at elements of its protected disclosure but did not assess these from a data protection perspective.
Mr Corr therefore decided to get the attention of the families involved by telling his story to RTÉ Investigates.
Even then, the Keoghs could have had no idea just how much their story was caught up in the media reports on this issue.
Or that extensive details from a private healthcare consultation they took part in in 2017 had been relayed back to the Department to help staff calculate a legal strategy.
Reassurances from the top
Confirmation that the Keogh’s case was at least implicated in the affair came a couple of weeks after the March 2021 broadcast involving Mr Corr – they received a letter from the Secretary-General of the Department, Robert Watt.
He reassured them, as he did more than 20 other affected families, that what Mr Corr had risked his job to reveal had been misconstrued, and that there had been no wrongdoing.
"I wish to confirm that the Department of Health has never gathered sensitive medical and educational information on children involved in court cases in the manner portrayed in recent media reports," he wrote.
Mr Watt restated this position when he appeared before the Oireachtas Health Committee to say that officials felt aggrieved by the suggestion there was anything wrong with a genuine effort to bring long-running cases to a close.
"Officials in the Department were as upset about what was said and the distress that it may cause families, as well as the fact that the allegations were untrue."
He also said "It is regrettable that motivation been twisted in a way to suggest something untoward was being done by officials, when they were trying to close cases which have gone on for too long and in which it was in the interest of all parties that they be closed."
At every juncture during the controversy the Department of Health stood firm. It issued media statements and it unsuccessfully attempted to intervene with RTÉ management prior to broadcast. It communicated to the public through the publication of an internal review, which had been ordered by the then taoiseach Micheál Martin.
The message was consistent and emphatic – that its information-gathering techniques were a normal part of litigation.
Mr Watt had told the Oireachtas committee that he believed the RTÉ Investigates report would "not stand up". And although no complaint was ever made to the then Broadcasting Authority of Ireland it left two positions, of Mr Corr and Mr Watt, that were impossible to reconcile.
Data inquiry
There was another interested party watching television as Mr Corr spoke about being able to access intelligence files on families who had been party to long-dormant cases from the mid-2000s.
This was staff at the Data Protection Commission.
"When we heard the allegations, we knew we would have to do an immediate inquiry… and it happened practically overnight, such was the level of seriousness with which we and the DPC took the allegations," said deputy commissioner, Tony Delaney.
In the midst of a Covid-lockdown the DPC acted swiftly to get to the Department and see could the files substantiate the claims Mr Corr had made – that the Department had kept secret tactical dossiers on litigants with material sourced directly and indirectly from confidential HSE services.
"I wanted to see were the excerpts that had been shown on Prime Time. Were they really there on the file? I was able to see all of those files. I did actually see them," Mr Delaney said.
Initially this was to "help the Data Protection Commission to make an adjudication of whether or not there was infringement of the Data Protection Act", he added. There was no prejudged conclusion.
The information
This initial visit, and three more that followed, found the records Mr Corr had made a central plank of his protected disclosure.
They included lengthy details direct from a HSE doctor who had conducted a confidential consultation with the Keoghs in June 2017. The Department had received this after contact initiated with the HSE through one of its template letters.
This correspondence from the doctor provided an assessment on issues Adam Keogh was facing as he approached adulthood, very specific personal feedback on the family dynamics and separate health care details about his sister, Amy, who had no role in the original case whatsoever.
According to Mr Corr it was shared on the specific proviso that the effected families should not be told about the practice.
"Well, I saw something that frankly I can only describe as shocking. I saw an e-mail from an official at the Department of Health to a doctor who is working for the HSE explaining that they were involved in litigation... and asking for information from this doctor.
"There was no way once I saw the piece of correspondence from the Department saying ‘we’re asking for information from you about a child but we’re not going to ask for consent to get it’. There was no way I was ever going to let that lie," Mr Corr said.
Adam Keogh says when he learned details from a doctor’s consultation he took part in in good faith was shared without his consent he felt "betrayed."
"They were still gathering information when I was finishing secondary school, and the case only covered primary school… They had no reason to research anything past primary school, and they didn't even have the justification to do what they did back then.
"To think that all of that would be reported to someone else when I was seeking help, when I was trying to get better, it's horrifying," he said.
The Keogh’s was the most egregious case because the Department’s contact happened to coincide with a previously scheduled healthcare appointment and – partly because of this – it involved direct communications with a doctor.
Other cases also involved private health information – which is supposed to enjoy special protections in data laws.
Those cases involved requests for updates that went to local HSE managers who gathered information indirectly on the families and fed it back to the Department.
The common thread was that the flow of information began with a broad scoping letter sent from the Department to HSE looking for service updates, giving instructions not to tell the families, and asking were there any other details worth mentioning.
"As a result of the template letter that was sent by the Department to the HSE, information came back into the Department for example, in relation to whether there was a crisis in the plaintiff's life, whether there was marital difficulties, for example, in the parents of the plaintiff's relationship and other things about their siblings," Mr Delaney said.
The Decision
However, Mr Corr’s gut instinct and Mr Keogh’s sense of betrayal were not what the DPC was focused on.
The DPC’s job was to ascertain if the documents in the case of Adam, his family and the other litigants broke the law.
Throughout the inquiry the Department maintained that its actions were grounded in normal legal activities.
The DPC quoted from the Department’s own submissions which said: "The creation of files and records in Special Education Needs (SEN) cases exclusively and directly flows from the initiation of [legal claims and/or proceedings]," according to the Department’s submission to the DPC.
During the summer, the DPC published its decision and found overwhelmingly against the Department.
It banned the Department from this type of processing, reprimanded it, and it issued a €22,500 fine.
"Our decision says unlawful things happened from a data protection perspective.. [The Department] broke the law," Mr Delaney, of the Data Protection Commission told RTÉ Investigates.
"The department is a powerful player in the State. But by contrast, the actual plaintiffs and their families were quite vulnerable people.
"And that's what makes it even all the more disturbing that what happened was such an unlawful practice that the state and an organ of the State was involved in an unlawful practice against vulnerable people," Mr Delaney said.
Trust was a key point and one which struck home with Mr Keogh when he learned at what had been shared from consultations he thought were private.
"What was done was completely and awfully wrong. There is no way to justify what has been done. None. I'm going to distrust the government for the rest of my life because of what has been done to me," he said.
The DPC decision carries comments from the Department in which it accepts much of the findings.
"The Department accepts the ban on the processing of personal data in the SEN litigation cases which has been confirmed as being neither necessary nor proportional for the purposes under which it was obtained," the Department said in correspondence cited in the DPC decision.
However, in a statement to RTÉ Investigates in July the Department still maintained it had not broken the law.
"Department has never actively obtained or unlawfully held sensitive medical and educational information of children involved in historical SEN court cases as outlined.
"The Department has accepted the corrective measure imposed by the DPC and are undertaking to implement them. We also acknowledge that historically, there were issues around retention and data minimisation, transparency and security controls, and have taken the appropriate steps to resolve these issues," it said.
Darragh O’Brien is a data protection expert and manages specialists in this area, Castlebridge Consulting.
"The DPC's decision torpedoed the Department's PR spin in relation to what they were doing," he said.
"It's a very clear principle of Data Protection Law that if you have a less invasive way of doing something - a way that requires less data about people - you should use that as your approach. That is the benchmark test called necessity proportionality."
It is a point that has left Sharon Keogh struggling for answers, after fighting for so much she was not expecting this fight would be brought to her after her son had reached adulthood.
"When you have a child with different abilities, everything is a struggle. It's impossible to get speech and language, physiotherapy, all those things. You have to fight for everything.
"This case was to get the five year old child the help he needed to enable him to learn in school. Simple as that."
In the Keogh’s case High Court proceedings had been largely defunct since 2007. The crucial communications that Mr Corr came across were from 2017 and 2019.
Internally in the Department the information gathering was being celebrated as an exercise well executed – which appeared oblivious to a massively changing world outside when all organsiations were being blitzed with news and warnings about the implementation of GDPR in May 2018.
Mr Delaney said there should have been better awareness of the need for better data gathering practices.
"There was quite a lot of publicity around the GDPR and about appointing data protection officers, et cetera. You would have expected that the department would have examined this issue and been aware that it could be problematic from a GDPR perspective, that never happened."
In a statement issued by the Department this week it said it now accepted that "the DPC found that the Department did infringe data protection law by asking broad questions that resulted in the Department receiving sensitive information about the private lives of plaintiffs and their families."
It said "sensitive personal data was historically, nonetheless submitted to the Department of Health by other parties… the Department accepts that under both European Union and Irish data protection legislation it was not proportionate nor necessary to retain such personal data."
And it said "the Department has initiated the corrective measures to ensure that the information retained and processed is done so on a strictly lawful basis."
Ms Keogh and her son said there now needs to be accountability.
"I never got an apology. And nobody else got an apology. Nobody got an apology. Not that an apology is going to make it better. It wouldn't, no, but at the same time, people that are well brought up apologize and they do something wrong," she said.
Wider Implications
Mr O’Brien works with a wide range of clients and for him he believes the implications of the DPC decision will be felt far beyond the Department of Health.
He said it will impact on how all public bodies share information between themselves – even if they believe there is a good reason to do so.
"We'll feel the ripples of this decision for quite some time because we'll have implications for public sector data sharing, because it reinforces the requirement for there to be a clear assessment of the necessity and proportionality of any sharing of data in the public sector context," he said.
For Mr Delaney and the Office of the Data Protection Commissioner its actions toward the Department of Health should put all public bodies on notice.
"The old order is dead… The Department got caught out, caught out very badly in this case, but others could be doing the very same thing today. And that's why they all need to take stock."
