Public Services Card database of millions of Irish people’s faces declared illegal
The Data Protection Commission (DPC) has found that the collection of facial (biometric) data for the Public Services Card (PSC) is unlawful.
The Irish Council for Civil Liberties (ICCL) said it partially welcomes the findings, but said the decision is "more than a decade late and inadequate".
The Government had previously claimed that the facial records were not biometric data. On Thursday, the DPC found that the Department of Social Protection (DSP) unlawfully collected facial records (biometric data) from 70 per cent of the population of Ireland over 15 years.
In addition, the ICCL said the department failed to tell people why it was collecting their facial records and whether it was legal.
In light of the infringements discovered by the DPC, it reprimanded the Department of Social Protection by issuing administrative fines totalling €550,000.
It also issued an order to the department requiring it to cease processing of biometric data in connection with SAFE 2 registration within nine months of this decision if the department cannot identify a valid lawful basis.
Deputy commissioner, Graham Doyle, said: “It is important to note that none of the findings of infringement identified, nor the corrective powers exercised by the DPC, pertain to the rollout of SAFE 2 registration by the DSP as a matter of principle.
"The DPC did not find any evidence of inadequate technical and organisational security measures deployed by the DSP in connection with SAFE 2 registration in the context of this inquiry.
"This inquiry was concerned with assessing whether the legislative framework presently in place for SAFE 2 registration complies with the requirements of data protection law and whether the DSP operates SAFE 2 registration in a data protection-compliant manner, and the findings announced today identify a number of deficiencies in this regard.”
'Illegal facial database'
The ICCL said the Data Protection Commission failed to take decisive action on Thursday and said that, after 15 years, its actions are not enough.
The ICCL is insisting on the immediate deletion of the illegal facial data database.
It has also called for the department and the DPC to explain to the Oireachtas and the public how this system was permitted to operate unlawfully for so long.
Executive Director of ICCL, Joe O’Brien, said: “For many years, ICCL and our colleagues at Digital Rights Ireland, have argued that the PSC’s mandatory use of facial recognition technology is unlawful.
“This is a partial win for the privacy and data protection rights of people living in Ireland. It confirms what we have advocated for, for many years - that the Public Services Card, which was estimated to have cost the State €100 million, trespassed upon human rights and infringed EU and Irish law.
“The DPC decision is over a decade late and does not go far enough. The Department effectively created a de facto national biometric ID system by stealth over 15-plus years without a proper legal foundation. This illegal database of millions of Irish people’s biometric data must be deleted.”
