Department of Social Protection fined €550k for unlawful database of millions of Irish people's faces
IRELAND'S MAJOR DATA watchdog has fined the Department of Social Protection €550,000 following a major investigation into its use of facial recognition technology linked to the Public Services Card.
The Data Protection Commission (DPC) inquiry, launched in July 2021, examined the DSP's 'SAFE 2′ registration process, which requires applicants to submit biometric facial data used for facial matching as part of their card application.
The Public Services Card is needed for accessing many welfare and public services, including applications for Child Benefit, Jobseeker's Benefit and driving licences.
A sample Public Services Card.
Department of Social Protection
Department of Social Protection
'SAFE 2′ registration has led to the Department of Social Protection holding biometric facial templates for about 70% of Ireland's population, making it one of the largest biometric data collections in the country.
The DPC inquiry found that the Department did not have a valid legal reason to collect or keep this sensitive facial data.
According to the DPC, the Department also failed to clearly inform people about how their data would be used, and the Department's privacy risk assessment was 'incomplete'.
As well as the €550,000 fine, the data watchdog ordered the department to cease processing biometric data for 'SAFE 2′ registration by March next year, unless a lawful basis is identified.
Deputy Commissioner Graham Doyle said that the DPC decision 'does not challenge the principle of SAFE 2 registration itself'.
'The technical and security measures in place for handling biometric data are sound,' Doyle said in a statement.
Advertisement
'Our concerns relate to whether the legal framework and the way the Department of Social Protection operates the system meet the requirements of data protection law. We found clear gaps in that regard.'
The DPC emphasised the need for a clear and precise legal basis when processing such sensitive data, as required by European privacy laws (GDPR), to protect individuals from arbitrary interference with their privacy rights.
The DPC's decision was made by Data Protection Commissioner Dale Sunderland, and was notified to the Department of Social Protection this week.
The Department of Social Protection has yet to comment on the ruling.
'More than a decade late'
The Irish Council for Civil Liberties (ICCL), which has campaigned against the use of facial recognition in the Public Services Card for more than 15 years, welcomed the decision but described it as 'more than a decade late and inadequate.'
Joe O'Brien, ICCL's Executive Director, said the ruling 'vindicates the actions taken by ICCL and Digital Rights Ireland against the Department of Employment and Social Protection'.
He said the ruling also confirmed what they had long argued – that the Department unlawfully collected facial records from millions without proper legal grounds or clear explanation.
'The Public Services Card, which was estimated to have cost the State €100 million, trespassed upon human rights and infringed EU and Irish law,' O'Brien said.
'The Department effectively created a de facto national biometric ID system by stealth over 15-plus years without a proper legal foundation. This illegal database of millions of Irish people's biometric data must be deleted.'
Olga Cronin, Senior Policy Officer at ICCL, criticised the mandatory nature of the facial recognition process.
'The Department unlawfully forced vulnerable people to give it their biometric data before it would help them,' Cronin said.
'It demanded data from people who needed its help to put food on the table. We should not have to trade our biometric data to access essential services to which we are already legally entitled.'
Readers like you are keeping these stories free for everyone...
A mix of advertising and supporting contributions helps keep paywalls away from valuable information like this article.
Over 5,000 readers like you have already stepped up and support us with a monthly payment or a once-off donation.
Learn More
Support The Journal
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
The Journal
5 hours ago
- The Journal
Irish citizens are now advised against travel to Israel
THE DEPARTMENT OF Foreign Affairs (DFA) has issued an advisory to all citizens not to travel to Israel after the country attacked Iran early this morning, prompting tit-for-tat strikes. The initial Israeli attack targeted Iran's nuclear programme as well as civilian areas in the capital Tehran, killing high-ranking members of Iran's military and Revolutionary Guard. The Department has updated its travel advisory for Israel to 'Do Not Travel' as it warns of a 'tense and unpredictable' climate arising from the anticipation of further missile strikes from both sides. On its website, the DFA says: 'There is an imminent risk of rocket fire, drone infiltration and ballistic missiles, which can occur without warning, and can disrupt civilian infrastructure, including transportation and communications. 'We strongly advise that citizens familiarise themselves with their closest protected location. Many buildings are fitted with 'safe rooms'; reinforced spaces designed to withstand missile attacks.' The DFA also urges Irish citizens in Israel to be aware of a list of public bomb shelters available for Tel Aviv and Jerusalem . It reminds citizens of the limitations of their travel around certain parts of Israel, namely the north of the country along the Lebanon border where it is closed due to military activity. It also says Israeli authorities reserve the right to deny entry to the country to 'foreign nationals who have publicly called for a boycott of Israel and/or settlements'. Advertisement Tánaiste Simon Harris spoke on RTÉ News at One earlier today where he confirmed the Department's updated travel advisory. 'The very clear travel advice from Ireland now is that no Irish citizen should travel to Israel,' Harris said, adding: 'We're keeping in very close contact with our diplomatic teams on the ground in Iran and in Israel.' He said that there are 'around seventeen' Irish citizens who are long-term residents in Iran, and that DFA is in regular contact with them. Global airlines on Friday cancelled flights to Tel Aviv, Tehran and other Middle East destinations, or rerouted planes, as airspaces shut following Israeli strikes on Iran. Israel, Iran, Iraq, Jordan and Syria closed their airspaces after Israel hit military and nuclear facilities in Iran. Israel said Tehran launched drones in retaliation. Air India's New Delhi-Vienna and Mumbai-London flights were about to enter Iranian airspace when Israel launched its attack, forcing the planes to turn back to their origin, according to aircraft tracker Flight Aware. The Russian embassy in Tel Aviv pressed Russians in Israel to leave the country if they could and said it 'strongly recommends' against travelling there until the 'situation normalises.' The Times of Israel reports that the state has closed all foreign embassies worldwide. 'Israeli missions around the world will be closed and consular services will not be provided,' said Israel's Foreign Ministry in a statement. The ministry also urged all its citizens living abroad to fill out a survey to update their location and situation. Readers like you are keeping these stories free for everyone... A mix of advertising and supporting contributions helps keep paywalls away from valuable information like this article. Over 5,000 readers like you have already stepped up and support us with a monthly payment or a once-off donation. Learn More Support The Journal
Irish Times
14 hours ago
- Irish Times
Other potential new names for the Department of Arts: Smacc, Cacs, Scam and – my favourite
The Government has lost the arts down the back of the sofa again. Look, it happens. It's probably nothing to worry about. It knows it's there. It hasn't abandoned the arts as if it were a failed IT project or anything. Not yet. This is about nomenclature. 'Arts' has been dropped from the name of the department in charge of it as part of a string of shake-ups, with the Department of Tourism, Culture, Arts, Gaeltacht, Sport and Media losing responsibility for tourism and the Gaeltacht and becoming the Department of Culture, Communications and Sport. [ Arts Council wrote to officials almost 60 times over botched IT project without issue being escalated Opens in new window ] On Wednesday we were treated to an official denial that this penalty was for the crime of starting with a vowel. Minister for Culture, Communications and Sport Patrick O'Donovan , as he's now known, was reportedly wary of a name change to the Department of Sport, Media, Arts, Culture and Communications because he didn't want to be Minister for Smacc. READ MORE Other acronyms were available. We could have had Cacs, which would have conjured up a lovely image every time, or Scam. My personal choice would have been to name it the Department of Sport, Arts and Communications and then dub it DoSac, in homage to the chaotic Department of Social Affairs and Citizenship from Armando Iannucci 's BBC satire The Thick of It. Asked about the Smacc theory at this week's meeting of the relevant Oireachtas committee – which still has arts in its title – the department's secretary general, Feargal Ó Coigligh , said the previous name was 'seen to be a mouthful' and the Minister was anxious that the new one be 'accessible'. Across European ministries, 'culture' was the term usually favoured. 'Culture is the normal word that's used,' he said, seeming relieved to take a break from raking over how the Arts Council spent €6.7 million on a botched, bug-riddled IT project. The upshot of the committee meeting, as summarised by its chairman, Alan Kelly of the Labour Party, was that the department has more questions to answer about its handling of that fandango. With O'Donovan opting not to appoint Maureen Kennelly for a further five-year term as director of the Arts Council , Kelly couldn't help feeling that she had become 'a sacrificial lamb'. There was some eagerness, too, about O'Donovan's scheduled appearance before the committee in early July. He may no longer be minister for the arts, but he is still, after all, the Minister in charge of the Arts Council. He's also the Minister who has backed extending the Basic Income for the Arts scheme beyond its pilot phase, though that doesn't, of course, guarantee the introduction of these financial lifelines for artists. This Coalition, like the one before it, is so good at being non-committal, and so adept at being angered and disappointed by various agencies and semi-States, that it seems a stretch to think it would bother vanishing 'arts' from the department name as part of any distancing exercise. But some believe the ditching bodes ill. Labour's arts spokesman, Rob O'Donoghue, has blasted the rebrand as shameful, saying that it sends a message – some might say an unnecessary one – to artists 'that they don't matter and aren't a priority'. Subsuming arts into 'merely culture' is symbolic of artists' status as 'the poor relation within the department', O'Donoghue suggests. It's a Smacc-down. Naturally, no one cares about 'media' being swallowed up by 'communications'. And few will remember that before the last name change, in 2020, the reconfigured department was first announced as the Department of Media, Tourism, Arts, Culture, Sport and the Gaeltacht before someone realised that this was not the correct pecking order and booted 'media' down the back. 'Arts' has, by comparison, enjoyed long spells on departmental stationery. Responsibility for it escaped the Department of the Taoiseach in 1993, when Michael D Higgins became minister for arts, culture and the Gaeltacht. Since then there have been two artsless periods – May 2010-June 2011 and August 2017-September 2020 – with culture reigning supreme both times. [ Up to 90: The best Irish words and phrases Opens in new window ] I haven't always been a fan of the term 'the arts'. I've recoiled from it because of the precious way that a minority invoke it as a kind of extension of their privilege, trumpeting it as a rarefied and narrowly defined practice, replete with gatekeeping and entitlement. 'Culture', by contrast, is a word that seems to reflect the entire sweep of creativity embedded in our lives. Culture is not 'merely culture'. It's inseparable from who we are. But these semantics are only safe to explore in the abstract, divorced from concerns about political expediency – even the slightest hint that it might be convenient for the Government to jettison 'arts' from the department name is enough to render the demotion ominous and, well, artless. It's possibly either too late or too soon for a Save the Arts campaign. Still, prepare your placards. We must start one in support of the establishment of the Department of Smacc right away.
Irish Examiner
19 hours ago
- Irish Examiner
Cianan Brennan: Why didn't government admit its error with biometric public services cards?
Six years ago, the Data Protection Commission (DPC) went mano-a-mano with the government of the day over the infamous public services card, and ended up in a long legal war of attrition. That battle involved a simple question: Could the card be used as a catch-all portal for citizens accessing the State's services, regardless of their wishes? That particular spat was more than a little unedifying, ending up in a wholesale climbdown on the part of the Department of Social Protection in December 2021. However, yesterday's decision by the commission to fine the department €550,000 and order it to suspend the biometric processing of the public's data via the card should be even more seismic. €550,000 is five times the amount of the next-largest fine for breach of GDPR by a public body, and more than half of the maximum allowable. Puzzling defence of the indefensible Six years is a long time, however, and the world is a different place now. This time round, the State may be more willing to take its punishment from its own regulator. That in itself would be borderline farcical. The government — former social protection minister Regina Doherty being probably the most noteworthy culprit — argued for years that the card did not carry biometric data, despite it being plainly obvious to anyone with common sense that it did — in this case, a photo used for facial matching. Why did the State spend hundreds of thousands of euro in taxpayers' money defending the indefensible? The answer may be because it couldn't afford not to. Why did it do so? Because it couldn't afford not to. Having stated until it was blue in the face that black was indeed white, to change tack in any way would have been legally disastrous. Why the government of the day couldn't just hold its hands up and admit fault in the first place, rather than spending hundreds of thousands of euro in taxpayers' money defending the indefensible, we may never definitively know. However, we can speculate. The card is deeply ingrained in Irish society now, but that wasn't the case to quite the same extent in 2019. Furthermore, back then GDPR was brand new. It was so new that the initial investigation into the public service card was carried out under Ireland's previous Data Protection Act. Under that act, the commission had far fewer teeth to impose fines. GDPR is now a firmly embedded, if not universally beloved, EU policy. Maybe in 2019 it was felt the time wasn't right for the government to eat crow on its ambitious biometric card venture. Range of views in data protection community Those we polled yesterday across Ireland's niche data protection community had different views as to whether or not the Government, in the guise of the Department of Social Protection, will go the legal route once more. One said: The circumstances have changed. The data protection and GDPR landscape is much clearer now than it was under the old act. 'It seems more likely than not that this is one that won't be challenged, at least not in court.' However, there was little consensus. 'For years, they [the department] have been shouting that there is no biometric data on the card. Now this decision from the regulator is unequivocal that there is. Can they really back down from that? Would that be in character?' a second expert asked. DPC will defend its decision 'very robustly' Should the Government press the nuclear button once more and appeal the decision to the courts, deciding commissioner Dale Sutherland has made it clear that 'we will very robustly defend our decision'. He said: We are well used to this. It is a feature of our system. There are other puzzling aspects to yesterday's decision, not least the sheer length of time it took. The biometrics investigation had been set in train even before the 2019 decision, which dealt specifically with whether or not the government had the right to make the card mandatory for public services such as passport applications, yet it was only officially commenced in July of 2021. It then took four more years to complete, during which time the card has become ever more embedded in Irish society. That is surely an inordinate amount of time to take over a key investigation concerning personal data. 'This was a complex inquiry with complex issues,' Mr Sutherland said. 'The resources these inquiries take are just extraordinary. This one took a bit of time,' he added, while allowing 'it's probably a bit longer than we would have liked'. Digital Rights Ireland, whose initial complaint spurred the investigations back in 2017, professed itself 'concerned' at the length of time it had taken to finalise the probe. A spokesperson added that the decision 'leaves the Government in a very serious situation', given it has spent 'hundreds of millions of euro on an illegal public service card project'. Mr Sutherland stressed, however, that 'the important thing is that it [the investigation] is done now'. Asked whether the world had moved on in the last six years, he said: 'The principles haven't.'
