Government slapped with record 550k fine over biometric data use in Public Services Card

pppTry from 150 weekppTry from 150 weekppppBiometric data refers to any information that can identify a person by their physical characteristics for example via a fingerprint or in the Public Services Cards PSC case a photograph Picture Gareth Chaney CollinsppThe Data Protection Commission has hit the State with a 550000 fine the largest GDPR penalty for a public body for processing peoples biometric data without a legal basis via the Public Services CardppThe DPC said that the Government must now discontinue processing such data using the PSC within 9 months unless it can find a legal basis for doing so ppBiometric data refers to any information that can identify a person by their physical characteristics for example via a fingerprint or in the PSC case a photographppThe State has long denied that the PSC uses biometric data despite a persons photograph appearing on every version of the card It has instead argued that it creates an arithmetic template from the photo for processing purposes a method it claims does not constitute biometric datappSuch data is classified as special category personal data under the EUs General Data Protection Regulation GDPR meaning it must be explicitly permitted in a countrys laws to be processed legallyppThere is no single law on Irelands statute books governing the PSC Its various uses are allegedly permitted through dozens of amendments to the 2005 Social Welfare Consolidation ActppIn addition to the 550000 fine five times greater than the next largest penalty for a public body and the order to stop processing biometric data the DPC also issued an official reprimand to the Department of Social ProtectionppThe Commission found that the card violated GDPR by failing to identify a legal basis for processing biometric data retaining that data without justification and not ensuring sufficient transparency about how the data would be used during registrationppDeputy Commissioner with the DPC Graham Doyle said that it is important to note that none of the findings of infringement identified nor the corrective powers exercised by the DPC pertain to the rollout of SAFE 2 registration the technical process by which PSC data is first collated and then stored by the DSP as a matter of principleppHe added that the investigation focused solely on how the PSCs biometric process complies with the GDPR noting that the findings announced today identify a number of deficiencies in this regardppIt remains unclear what will happen next However if the Government accepts the report it will finally need to introduce specific legislation through the Oireachtas to legalize the PSCppA spokesperson for the Department of Social Protection said the body believes that it has a valid legal basis and that it does satisfy the requirements of transparency including the biometric processing elementppHowever we will carefully consider the DPC decision report in conjunction with colleagues in the Attorney Generals Office with a view to determining an appropriate response they added ppIn announcing its conclusions the DPC has brought to a close its lengthiest domestic data protection saga one which had lasted close to 8 yearsppBy announcing its conclusions the DPC has ended its longest domestic data protection investigationa process that lasted nearly eight yearsppIn August 2019 the DPC ruled that the State had no lawful basis for making the PSC originally conceived in the 2000s as a welfare benefits card by the Department of Social Protection mandatory for all public servicesppThat decision led to a prolonged legal battle between the State and one of its own regulators The dispute ended in a December 2021 settlement with the DPCs findings left unchallenged but the State continuing with the PSC projectalbeit without mandatory requirementsppA separate investigation into the biometric nature of the card ran concurrently with the original report Initially it was expected that this investigation would publish its findings by the end of 2019ppWhile the conclusions of the biometric investigation are not surprising todays publication comes nearly six years later than anticipatedppThe PSC is now used daily by millions of Irish citizensnot just for receiving welfare payments but also for services such as renewing driving licences and accessing the National Childcare SchemeppppppTry unlimited access from only 150 a weekppAlready a subscriber Sign inppIrish Examiners WhatsApp channelppFollow and share the latest news and storiesppMore in this sectionppppppppppMonday July 7 2025 1000 AMppMonday July 7 2025 700 AMppMonday July 7 2025 900 AMpp Examiner Echo Group Limited Linn Dubh Assumption Road Blackpool Cork Registered in Ireland 523712pp Examiner Echo Group Limitedp