Department of Social Protection fined €550,000 over facial scans

Irish Times

12-06-2025

The
Department of Social Protection
has been fined €550,000 after data protection watchdogs found 'a number of deficiencies' in its compliance with European data privacy rules concerning the use of facial scans in issuing Public Services Cards.
The Department was also ordered to come up with a valid lawful basis for the use of facial scans and facial matching software for the registration of Public Services Cards within nine months, or it must stop using it.
The decision is the result of an inquiry that the
Data Protection Commission
commenced in July 2021, examining the department's processing of biometric facial templates and the use of facial matching technologies as part of the registration process for the Public Services Card.
The department uses Safe 2 registration to verify identity when accessing public services. The process involves a photo of the applicant, which is then run through software to check against images used in other Safe 2 registrations. This is designed to prevent duplicate registrations.
READ MORE
The registration is mandatory for applying for a Public Services Card, of which 3.2 million are in existence, and is necessary for certain services, including welfare payments.
[
'No legal basis' for photo database created using Public Services Card
Opens in new window
]
However, that means there is ongoing collection, storage and processing of sensitive personal data on a large scale by the DSP, which requires precise legal justification, the DPC said.
The inquiry looked at whether the DSP had a lawful basis for collecting biometric data for conducting facial matching as part of Safe 2 registration, if it could retain that data, if it complied with transparency obligations, and if it had carried out an adequate Data Protection Impact Assessment.
The DPC found the department had infringed data protection regulations on a number of fronts. In its decision, the regulator said it failed to identify a valid lawful basis for the collection of biometric data for Safe 2 registration at the time of the inquiry. As a result, it also infringed GDPR by retaining biometric data collected as part of Safe 2 registration.
The DPC also penalised the department for infringing its obligations on transparency, and for failing include certain details in the Data Protection Impact Assessment that it carried out.
The DPC said it had reprimanded the Department of Social Protection and issued the administrative fines. The department must also stop biometric data in connection with Safe 2 registration within nine months of this decision, if it cannot identify a valid lawful basis for the data collection.
'It is important to note that none of the findings of infringement identified, nor the corrective powers exercised by the DPC, pertain to the roll-out of Safe 2 registration by the DSP as a matter of principle. The DPC did not find any evidence of inadequate technical and organisational security measures deployed by the DSP in connection with Safe 2 registration in the context of this inquiry,' said deputy commissioner Graham Doyle.
'This inquiry was concerned with assessing whether the legislative framework presently in place for Safe 2 registration complies with the requirements of data protection law and whether the DSP operates Safe 2 registration in a data protection-compliant manner, and the findings announced today identify a number of deficiencies in this regard.'
A previous inquiry into the processing of personal data in connection with the issuing of Public Services Cards was concluded in 2019, with the department initially appealing the DPC's decision before withdrawing the action and coming to an agreement with the watchdog.