Irish biometric public services access card not to be mandatory

The Irish government has backed down from a legal challenge against the country’s Data Protection Commission (DPC) on usage of the national biometric Public Services Card, processing of the data collected and the card registration process. The DPC is lifting a block it placed on aspects of the controversial card while departments must accept other methods of identity authentication.

The dispute goes back to August 2019 when the Data Protection Commission issued a report on the Public Services Card (PSC) and the biometric enrollment process known as SAFE Registration where individuals attend a center with certain documents and have a face photo taken and provide an electronic signature which are used to issue the cards.

The report went to the very roots of the issue to question the legal basis of the PSC and its uses. The DPC issued an Enforcement Notice to the Department of Social Protection which manages the PSC process. The notice required the department to cease all processing of data carried out for SAFE registration and PSC issuance other than where a PSC is being issued specifically for a person claiming or receiving a welfare benefit from the department.

The enforcement effectively restricted the rollout of the requirement of the card for other government departments.

The Department of Social Protection appealed against the DPC’s findings. The appeal was due in court on 7 December 2021, but the department reached an agreement with the DPC which has cancelled its enforcement.

The settlement allows the Department of Social Protection to continue processing personal data that is necessary and proportionate to authenticate a person’s identity and issue them with a PSC to be used for accessing public services. The DPC finds that use of SAFE and the PSC has legal basis for welfare provision, providing departments involved also accept another authentication method.

The Department of Social Protection and others can continue to used Ireland’s digital identity verification system for public service access, MyGovID, as an individual’s sole means of authenticating identity (it is accepted as sufficient), but it cannot be a department’s sole means to authenticate individuals. A PSC (and therefore SAFE registration) is required in order to enrol for a MyGovID.

The Department and the DPC will also work to ensure that any non-essential data collected during a SAFE registration is either permanently deleted or irreversibly redacted. The Department will also make changes to its privacy statement.

“I am very pleased that this matter has been resolved. Given the high level of PSC/MyGovID take-up, today’s agreement is good news both for our citizens and public service providers,” states the Minister for Social Protection, Heather Humphreys, in a government statement.

“Most importantly, the agreement means that members of the public can continue to apply for their Public Services Card for the purposes of transacting with government departments, which has proven extremely useful given the increased online interaction during COVID-19.”

The Irish government recently announced modelling that showed huge savings from using the MyGovID system, and elsewhere in Irish identity news, there is a predicted record demand estimated for passport processing in the next year. A new passport processing contract has been awarded to HID Global.

Article Topics

authentication  |  biometric data  |  biometrics  |  data protection  |  digital ID  |  electronic-signature  |  identity management  |  identity verification  |  Ireland  |  national ID  |  privacy  |  social security