Ireland's Data Protection Commission fines DSP €550k for facial recognition in Public Services Card
Ireland's Data Protection Commission fined the Department of Social Protection €550,000 for using facial recognition in its Public Services Card registration system without a valid lawful basis, transparent notification, or proper legal justification. The regulator ordered the department to establish a valid legal basis within nine months or cease the biometric processing that affects 3.2 million cardholders.
What happened
The Data Protection Commission (DPC) investigated the Department of Social Protection's use of facial recognition technology in the SAFE 2 registration process for Public Services Cards, which commenced in July 2021.
The DPC found breaches of GDPR relating to failures to identify a valid lawful basis for the collection of biometric data, the retention of biometric data collected, and failures to put in place suitably transparent information to data subjects.
Reported impact
The DPC fined the Department of Social Protection €550,000 and issued a reprimand. The DPC issued an order requiring the department to cease the processing of biometric data in connection with SAFE 2 registration within nine months if the department cannot identify a valid lawful basis.
The process involves processing facial templates and facial matching of 3.2 million Public Services Cards, which are mandatory for accessing certain public services including welfare payments.
Index analysis
The DPC did not find evidence of inadequate technical and organisational security measures deployed by the DSP in connection with SAFE 2 registration. The department stated it believes it has a valid legal basis and satisfies transparency requirements, though the DPC determined the legal provision was not clear and precise enough.
Governance controls
The inquiry assessed whether the legislative framework for SAFE 2 registration complies with data protection law requirements and whether the DSP operates SAFE 2 registration in a data protection-compliant manner, identifying deficiencies in both areas.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.