Mental Health Commission (Register of Users)

Last Updated August 2019

Does your organisation use the PPS Number at present ?

Yes.

If so for what purpose?

The MHC utilises the PPSN for normal business purposes in relation to payroll processing and related activities.

Does your organisation exchange the PPS number with any other body? If so please name the relevant bodies and the purpose(s) of the exchange?

The MHC exchanges the PPSN with Revenue, DSP and its contracted payroll service providers as part of normal related business in this area.

Does your organisation have any other plans involving the use of the PPS number?

In light of the inclusion of the Decision Support Service within the remit of the MHC, the MHC is of the view that the PPSN will be of key importance in providing a unique identifier that can be used for the purposes of retaining registers of decision making arrangements. The scope and methodology to be applied in relation to the use of the PPSN, within the limits stipulated by relevant data protection legislation, is currently in development. PPS Numbers will not be collected until the Decision Support Service is operational which is not expected before the end of 2020.

There is a duty to ensure compliance with the principles of processing personal data which are set out in Article 5(1) and 5(2) of the GDPR. These principles are summarised as follows:-

• Process it lawfully, fairly, and in a transparent manner;
• Collect it only for one or more specified, explicit and legitimate purposes, and do not otherwise use it in a way that is incompatible with those purposes;
• Ensure it is adequate, relevant and limited to what is necessary for the purpose it is processed;
• Keep it accurate and up-to-date and erase or rectify any inaccurate data without delay;
• Where it is kept in a way that allows you to identify who the data is about, retain it for no longer than is necessary;
• Keep it secure by using appropriate technical and/or organisational security measures;
• Be able to demonstrate your compliance with the above principles; and
• Respond to requests by individuals seeking to exercise their data protection rights (for example the right of access)

Have you measures in place to ensure that the Public Service Identity data you hold/collect whether in electronic or written format is in line with the GDPR Principles described above??

Yes.