DSP challenges Irish data regulator’s fine, says processing face biometrics is legal

It’s knuckles up for Ireland’s Department of Social Protection (DSP), which is challenging a ruling by the Data Protection Commission (DPC) claiming it had no legal basis for the collection of biometric data as part of the process of issuing Social Protection Cards.

The biometric data in question is face biometrics, specifically biometric facial templates used for facial matching as part of the so-called SAFE 2 registration process required for a Social Protection Card application.

The DPC’s decision, which accuses the DSP of violating key provisions of the General Data Protection Regulation (GDPR), ended an investigation begun in July 2021. It comes with a fine of 550,000 euros (about US$585,000) and the order for the DSP to stop processing biometric data within nine months if it cannot identify a valid lawful basis for doing so.

Taking that time to find a legal reason to collect biometrics might seem like the easiest option for the DSP. Nonetheless, it has chosen to contest the ruling, launching High Court proceedings to argue that what it’s doing is, in fact, legal. Irish Legal News quotes a spokesperson for the Department of Social Protection, who says “the Department believes that its processing of biometric data is compliant with data protection law.”

Expert declares challenge a waste of time and money

It may take several years and hundreds of thousands of euros to find out who’s right. In the view of data protection expert Daragh O’Brien, who works for the Wexford-based firm Castlebridge, the effort amounts to a waste of time and funds.

“It would seem that rather than take the time generously allowed by the DPC to cure the issues identified in their unpublished decision that gave rise to the fine and enforcement notice, the department has opted to fight,” O’Brien says in a quote to the Irish Examiner. “I predict a long, drawn-out waste of taxpayer’s money on a battle that will wind up in the CJEU (Court of Justice of the European Union) with another loss for the State.”

Article Topics

biometric data  |  biometrics  |  data collection  |  data protection  |  face biometrics  |  Ireland