John Paul O'Shea (Cork North-West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I will read a note on privilege and housekeeping matters before we begin. Witnesses and members are reminded of the long-standing parliamentary practice that they should not criticise or make charges against any person or entity by name or in such a way as make him, her or it identifiable or otherwise engage in speech that would be regarded as damaging to the good name of the person or entity. Therefore, if their statements are potentially defamatory in relation to an identifiable person or entity, they will be directed to discontinue their remarks. It is imperative they comply with any such direction that I might make.

Members attending remotely are reminded of the constitutional requirement that to participate in public meetings they must be physically present within the confines of the Leinster House complex. This is due to the constitutional requirement that to participate in public meetings members must be physically present within the confines or place where the Parliament has chosen to sit. In this regard, I ask members attending via Microsoft Teams to confirm they are on the grounds of the Leinster House complex if they wish to contribute to the meeting. I remind all those in attendance to make sure their mobile phones are switched off or put on silent mode.

The purpose of this evening's meeting is to resume pre-legislative scrutiny of the general scheme of the social welfare and other matters Bill 2026. The general scheme provides miscellaneous amendments to the Social Welfare Consolidation Act 2005 and the Civil Registration Act 2004. It also makes amendments to the Charities Act 2009. I welcome the following witnesses from the Data Protection Commission, Mr. David Murphy, deputy commissioner, and Ms Lauren Burke, assistant commissioner; and from University College Dublin, Dr. Elizabeth Farries, director of the UCD centre for digital policy. They are all very welcome. I invite the witnesses to make their opening remarks.

Mr. David Murphy:

I thank the committee for the invitation to contribute to its deliberations on the general scheme of the social welfare and other matters Bill 2026. I am one of the deputy commissioners at the DPC, with responsibility for the DPC’s supervision functions with regard to the public sector. Also in attendance is Ms Lauren Burke, assistant commissioner from the DPC’s supervision section with responsibility for matters pertaining to the provision of digital public services.

I would like to inform the committee that the Department of Social Protection has commenced statutory consultation with the DPC on the Bill as required under Article 36(4) of the GDPR and that process is ongoing. This Bill is intended to amend and extend the social welfare Acts, to amend and extend the Civil Registration Act 2004, to amend and extend the Charities Act 2009 and to provide for other related matters. For the purposes of this meeting, the comments of the Data Protection Commission will be focused on head 7 of the general scheme relating to the public services card, PSC, which has the most significant impact upon the processing of the personal data of individuals.

Head 7 of the general scheme introduces four amendments to section 263 of the Social Welfare Consolidation Act 2005, as amended, in the following terms. The first amendment provides for the holder of a PSC to voluntarily provide it to an entity or person not specified in Schedule 5 to the Act for the purposes of establishing their identity. As set out in the explanatory note to head 7, this facilitates the use of the PSC as a reliable identity document similar to a passport or driving licence when people are required to provide proof of identity to avail of a product or service, typically financial or utility. It is important from the DPC’s perspective to note that this amendment allows for the cardholder to voluntarily provide their card at their own discretion and it does not create a legal basis for third parties not specified in Schedule 5 to the Act to compel the production of the card. In the operation of this provision, third parties that process personal data from the PSC will be subject to compliance with the GDPR. In line with the principle of purpose limitation, they should only process personal data from the PSC as is necessary for the purpose of establishing the identity of the cardholder and for no further purposes.

The second amendment provides for the inscription of the date of birth of the cardholder on the PSC, allowing its use as proof of age in relevant situations. From a data protection perspective, it is important to note that the addition of the date of birth is based upon the consent of the cardholder. As per the requirements of the GDPR with regard to consent, the cardholder will be facilitated in removing the date of birth from the card at their own volition.

The third amendment removes the obligation for the PSC to be encoded electronically with personal data of the cardholder and provides that such data may be encoded where necessary to achieve a particular purpose, such as to provide a machine-readable token for participation in the free travel scheme. The DPC welcomes this provision as it aligns with the principle of data minimisation, which requires that personal data processing should be limited to what is adequate, relevant and necessary to achieve the particular purpose or purposes for which they are collected.

The fourth amendment provides that the PSC shall remain the property of the Minister at all times. This presents no issues from a data protection perspective and in fact may protect the cardholder from possible unauthorised use of the card by a third party. This will bring the PSC into line with other State-issued identity documents such as the passport or driving licence.

I hope these comments will be of assistance to the committee. I am happy to answer any questions members may have and to speak to any of these issues.

Dr. Elizabeth Farries:

I thank the joint committee for the opportunity to discuss matters arising in relation to this general scheme. A central issue within the scheme, particularly under head 7, is Ireland’s public services card. As drafted, head 7 appears to further normalise the PSC as a general purpose identity card through additional amendments to an already complex legal framework. Most strikingly, it appears to expand PSC use without resolving the core legality issues that continue to surround the system.

The PSC issued in Ireland was never simply about a physical card, rather, it concerns the broader somewhat paradoxically named SAFE system, a state biometric identify infrastructure that expanded far beyond its original welfare administration purpose into multiple areas of public service access. This expansion occurred despite long-standing concerns raised by data protection experts, civil liberties organisations, community groups and a former UN special rapporteur on extreme poverty. These concerns ultimately foreshadowed the findings of the Data Protection Commission in 2019 and 2025, including findings that there was no lawful basis for certain PSC-related processing beyond core social welfare purposes.

Head 7 does not appear to resolve these long-standing concerns, including the fact that the PSC is becoming effectively mandatory. While the Bill frames the PSC use as voluntary, voluntary identity systems can become de facto mandatory when banks, landlords, employers, utilities or service providers begin treating them as the preferred form of identification. If alternative forms of identification become slower, more burdensome or viewed with suspicion, individuals are effectively nudged towards universal use. The long-standing concern regarding the emergence of a national identity card in Ireland by stealth therefore remains unresolved.

Expanding the PSC into everyday life also risks embedding it as a universal identifier across public and private sectors. This creates the foundations for a broad interoperable identity infrastructure in which data sets become linkable, profiling becomes easier and information collection for one purpose migrates into others.

These risks are not hypothetical. By 2023, it had emerged that the PSC-linked transport data included journey times, locations, routes and unique identifiers capable of re-identifying individuals with data-sharing occurring between Departments. None of that was supposed to happen under the legal framework.

Then there is the question of biometrics, also referred to as face surveillance or facial recognition technology. Perplexingly, the Bill does not appear to address these foundational legality issues. Instead, it focuses on downstream card usage rather than the upstream illegal biometric infrastructure that enables the card's issuance. Before expanding PSC use further through head 7 of the general scheme, reasonable questions arise. Has the unlawful biometric processing ceased? Has a valid legal basis now been established? If so, where is that legal basis contained?

Then there is the question of vulnerable populations. The general scheme is now framed in user-friendly language, particularly around assisting "vulnerable" people who may not possess passports or driving licences. Accessibility is of course always important, but there is an uncomfortable contradiction in now presenting the PSC as protective of vulnerable populations when the system historically emerged through welfare fraud narratives that disproportionately targeted those same groups. Political rhetoric surrounding the "welfare cheats" and the "people who get up early in the morning" reinforced harmful assumptions regarding poverty, disability and unemployment in Ireland. The former UN special rapporteur on extreme poverty concluded the PSC regime "gravely prejudice[d] the least well-off" and risked discriminatory impacts.

The issue raised by the general scheme is not whether some individuals would like to use the PSC as a convenient proof of identity but whether Ireland continues to incrementally construct a de facto national identity scheme through piecemeal amendments following years of contested discrimination, biometrics and legality. Might Ireland yet learn here an important lesson about on-boarding risky and sensitive surveillance tech without clear legislative bases, meaningful democratic debate or robust safeguards? Could Ireland, a jurisdiction at the heart of gold standard data protection governance, including the GDPR, take this opportunity to reset and model, as a global example, important principles? That is ultimately the question before the committee in relation to the general scheme.

John Paul O'Shea (Cork North-West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Thank you very much, Dr. Farries. I invite members to discuss the general scheme. I remind members participating remotely to use the "raise hand" feature of Teams if they would like to contribute and to cancel it when they have spoken.

Johnny Guirke (Meath West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I thank all the witnesses for coming in. What safeguards will prevent private companies from making the PSC the default or preferred form of identification? If a utility provider or financial institution insists on a PSC when another form of identification should suffice, what enforcement powers would the Data Protection Commission have? Would the DPC support a legal obligation requiring third parties to clearly inform people that presenting the PSC is optional? I have a couple more questions but I will start with those.

Mr. David Murphy:

On the first question about what safeguards would prevent these third parties compelling the use of the card, we would start with the legislation. It provides that production of the card and use of it as purely a form of identification is predicated on it being voluntary under the amendment Bill. As I mentioned in the opening statement, any use of the card by those third parties, such as a bank or utility provider, would be governed by the GDPR. That means they could only process data contained in the card for the purposes for which it is presented, namely, the verification of identity. My understanding is it would remain an offence under the Social Welfare Consolidation Act for that third party to seek the production of the card where not so required. As a non-specified body, it would not be in a position to seek the card and could only accept it on voluntary production by the cardholder.

On the DPC's powers, we have the obligation to investigate any complaint by a cardholder where they felt they had been perhaps pressurised or compelled to produce the card, and to examine the actions of that third party in terms of processing the personal data held on the card and what they then did with that. As for a legal obligation to inform the cardholder that the use is voluntary, to fall back on the pre-existing obligations of the GDPR, that third party is bound by the transparency obligations of the GDPR to process personal data in a lawful, fair and transparent manner and to explain to individuals why it is seeking their data and for what purposes. That could be strengthened by a specific requirement in this amendment Bill to inform the individual that the use of the card is voluntary in this situation. However, that is already covered by the transparency obligations on that party under the GDPR, which would be monitored and enforced by the DPC in accordance with our powers under that regulation.

Johnny Guirke (Meath West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Why was a full date of birth chosen rather than an age verification mechanism that discloses only whether a person is over 18 years of age? How simple and accessible will the process be for removing the date of birth from the PSC? Will people be informed proactively from the outset of their right to opt out of having their date of birth displayed?

Mr. David Murphy:

On that question, the DPC is in continuing consultative engagement with the Department on the policy choices around this. Our understanding is the date of birth is to facilitate the use of the card as an age verification form of identity, in addition to the passport and the driving licence. Again, that is at the volition, and with the consent of, the cardholder. From our point of view, it is important the word "consent" is used by the Department because consent, under the GDPR, is a very defined term. It must be freely given, must be specific in its content and, in particular, to answer the Deputy's question, it must be as easy to withdraw consent as to grant it. We will expect that, should this amendment Bill go through, the Department will institute very clear, transparent and easy processes for individuals to either request the date of birth go on the card or be removed should they wish to do so, as is required for a valid consent under the GDPR.

Johnny Guirke (Meath West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Has the DPC conducted or requested a data protection impact assessment for these amendments? Does it believe the State is moving incrementally towards a national digital identity system? If so, what democratic safeguards should apply? What lessons, if any, has the DPC taken from other EU states where national identity systems expanded beyond their original purpose?

Mr. David Murphy:

On the Deputy's first question, it would be the responsibility of the Department to determine, on the basis of risk, whether a data protection impact assessment, DPIA, would be required to bring through these amendments. On our current examination, we do not consider these particular amendments, in terms of the voluntary usage of the card or the introduction of the date of birth, are likely to be high-risk data processing, so it is not clear that a DPIA would be required. However, were the Department to carry one out, we would be happy to examine that and provide comments.

On the broader question of the card, I will preface my remarks by pointing out the decision of the DPC's second inquiry, which was referred to by Dr. Farries, of last year into the public services card is under appeal by the Department and will be before the courts in the coming weeks. As such, I am somewhat limited in what I can refer to in that context. What I would say is that, at a high level, the DPC considers a comprehensive review of the legislation underpinning the PSC is needed and we recommend that the Government do so from a data protection perspective to ensure, going forward, there is a clear, precise and foreseeable legal basis underpinning the public services card and all related data processing. This bears out our findings in the two investigative processes. Rather than questioning at this point the Government's policy choices in relation to the card, our aims are, in particular, to ensure the law - the legal basis underpinning the card - is clear, precise, foreseeable and sets out understandable purposes as is required by the principles of data protection, by the GDPR and by the case law of the Court of Justice of the European Union.

Catherine Ardagh (Dublin South Central, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I thank the witnesses for coming and for their presentations.

Dr. Farries gave quite an impactful statement in relation to the concerns that arise, especially regarding the profiling of individuals and communities. Can the Department confirm whether any automated data matching, risk scoring or behavioural analysis tools will be operated alongside the public services card system? If so, what safeguards are in place to ensure individual communities are not disproportionately flagged or profiled? Especially when data are being shared with other Departments, what safeguards are in place to ensure those Departments do not use it to profile individuals or communities, especially when it comes to background, race, residence, disability or any other sensitive characteristics?

Mr. David Murphy:

The Department is not in a position to get into the policy behind implementation. From the Data Protection Commission’s point of view, a number of matters come into play in respect of the Deputy’s question on the sharing of data. The sharing of data between Departments is governed by the Data Sharing and Governance Act 2019, and we expect that any sharing of personal data would be done in a manner that accords with its provisions.

Moving on to the question on profiling, and in particular profiling on the basis of special-category personal data, such as vulnerability and health data, these are governed by the GDPR in the first instance. Again, there must be a clear basis for any processing. Simply establishing the card as a mechanism would not necessarily create a downstream legal basis for the ongoing or further sharing of data between Departments. There would need to be an identified legal basis in each case for that to take place.

The GDPR is quite clear on profiling and, in particular, profiling on the basis of automated processing of personal data. We are very clear that all Departments involved in using the card in processing data would need to be cognisant of their responsibilities as data controllers under the GDPR. We are aware that there is increased interest in bringing automation and perhaps AI-driven tools into the work of government. As long as that is done in a responsible way, it is not inherently problematic. Where AI-based automated processing may lead to real-life decisions about people, however, there is an implicit right to object and a right not to be subject to that type of processing under the GDPR.

Catherine Ardagh (Dublin South Central, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

If a Department with which information is shared breaches the agreement with the commission, are there are any sanctions from the Department? Is the DPC where any sanction would come from?

Mr. David Murphy:

The DPC does not specifically regulate under the Data Sharing and Governance Act. However, it considers any data sharing through the lens of the GDPR. Maybe the most relevant case in this regard would be our recent inquiry into the Department of Health on the processing of personal data in anticipation of special needs education litigation. That inquiry looked into the sharing of data between the HSE and the Department of Health. To summarise, it determined that while there may have been a legal basis, the sharing of data in anticipation of that litigation was excessive in terms of what may have been required and was not done in a transparent manner.

Catherine Ardagh (Dublin South Central, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

What were the repercussions?

Mr. David Murphy:

The DPC issued a ban on processing and imposed a fine on the Department. I cannot recall the amount. It also ordered the deletion of the data in that case.

Catherine Ardagh (Dublin South Central, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

What is the basis for collecting the biometric data and for how long will the Department retain it? Will it be shared with third parties? What safeguards are in place to prevent misuse? I presume it goes back to the DPC.

Mr. David Murphy:

Again, due to the fact that the case related to our inquiry into the use of biometric data in the SAFE 2 registration process is before the courts in the coming weeks, I am a little limited in what I can say about it, other than to recap our findings in the inquiry. We found that the Department of Social Protection failed to identify a lawful basis for the collection of biometric data, in infringement of Articles 5(1)(a), 6(1) and 9(1) of the GDPR, and consequently, in our view in the inquiry report, unlawfully retained that data. It was not done in a transparent manner, leading to further infringements of the GDPR. As the matter is in the hands of the court, I cannot go into much more detail, unfortunately.

Catherine Ardagh (Dublin South Central, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

My final question is for Dr. Farries. Her statement is quite frightening. To ask my question in layman’s language, why should people watching at home be concerned? Obviously, they understand the concept of profiling.

Dr. Elizabeth Farries:

I thank the Deputy for the question. It is an important one and it relates to a question her colleague asked. In a scheme such as that for the public services card, once a single identifier - for example facial characteristics - or a database becomes widely used across the public sector, it opens up the possibility of use in the private sector. This facilitates data linkage, the profiling problem to which the Deputy referred and function creep, particularly where safeguards are weak. Here is the problem: once that infrastructure is in place, it can be incredibly hard to protect. It is very easily compromised. We need only look to the UK, which is actively seeking to remove data-sharing barriers and enable real-time data access. This involves onboarding risky private surveillance technology such as Palantir technology into sensitive health systems. Once that is in place, the guardrails come down very easily.

The warning around national ID systems generally, and that is certainly what the PSC is, is that long-raised concerns around privacy and surveillance, and the expansion of State data infrastructure beyond its original purposes, continue to arise. The more we learn, the more we see how these systems are not only about efficiency and access to services. We see problems relating to proportionality, democratic oversight, discrimination risks and the protection of fundamental rights showing up time and again. The London School of Economics and Political Science wrote about this very clearly in a massive study published 20 years ago, showing that national ID systems are extremely difficult to implement in a way that does not undermine legality or privacy. Those findings are reflected here in relation to the PSC, 20 years later, as a practical case study.

With respect to the heads of the Bill, head 7 should be done away with in its entirety. If we are to accept that Ireland needs a public national ID card, we need to start from scratch and build the primary legislation with adequate consultation.

John Paul O'Shea (Cork North-West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I thank Dr. Farries. We are out of time, so we will move on to Deputy Aird.

William Aird (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Does the DPC believe that although the use of the public services card with third parties is voluntary, there is a risk that banks, utilities or landlords could effectively make it required? What safeguards would prevent this becoming compulsory de facto?

Mr. David Murphy:

I believe there is a risk. We have seen this in the DPC’s work in respect of landlords, whom the Deputy mentioned, perhaps seeking excessive personal data in order to grant people access to properties. We would look to see the question of what the public services card can be used for handled transparently by the Department if this legislation is enacted. We would then have to consider our own enforcement mechanisms to monitor the use of the card by different sectors and ensure individuals are not inappropriately compelled to produce it.

William Aird (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

That is grand. Is the DPC is satisfied that consent to include date of birth on the public services card is freely given and can be withdrawn without disadvantage in practice when dealing with public services?

Mr. David Murphy:

To date, from our engagement with the Department through the consultative process, we have not identified any matters giving rise to significant concern about handling on a consensual basis. As I mentioned in response to a previous question, under the GDPR it must be as easy to withdraw consent as it is to grant it. This should be facilitated.

William Aird (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Does the DPC consider there is a risk that expanded use of the public services card could lead to function creep towards a de facto national ID system? What limits would be needed to prevent that?

Mr. David Murphy:

I refer the Deputy to Dr. Farries’s answer to the previous question in that our investigative work in the two inquiries to date has covered the specific legal basis for the public services card rather than the policy objectives, which in the view of the DPC would be best addressed through a comprehensive review by the Government of all the legislation underpinning the purposes of the card, its scope and the lawfulness of the process.

William Aird (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Given the Data Protection Commission's previous findings on unlawful biometric processing, can Mr. Murphy clarify whether a fully compliant legal basis for the public service card biometric system now exists? If so, why is it not explicitly addressed in head 7 of this Bill?

Mr. David Murphy:

From the DPC's point of view, at the conclusion of our 2025 inquiry we provided a period of nine months for the Department to bring its processing and biometric data into compliance. There were preliminary conversations with the Department around possible legislative moves to do that. However, the inquiry decision was subsequently appealed and is now in the hands of the court to see whether our findings will in fact be borne out.

William Aird (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Does Mr. Murphy accept the concern that even if the use of the public services card is framed as voluntary, its expansion into private service risks creating a de facto mandatory national ID system through function creep and institutional pressure?

Mr. David Murphy:

The risk is certainly there, and it is a risk that will have to be managed by the Department and the Minister, as the owners of the card. This is further made clear by the amendments. We expect the Department will seek to manage and monitor the use of the card through the Act. As a regulator, the DPC will, through the lens of GDPR, monitor and enforce the processing of data in this context. Certainly, the risk exists and is there to be handled.

William Aird (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

How does Mr. Murphy reconcile the stated aim of supporting vulnerable groups with the previous DPC findings that the public service card biometric processing may have unlawfully affected the same groups? What concrete safeguards now prevent reoccurrence of this?

Mr. David Murphy:

I would divide that in two. Looking at the present amendment, we can take the Department's view that allowing for the voluntary use of the public services card can be of benefit to those individuals who perhaps do not have a passport or driving licence, particularly when the passport costs money whereas the public services card is free. We see that argument. Again, with biometrics, I am limited in what I can say until the outcome of the appeal of our decision.

William Aird (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Does Mr. Murphy believe the data-sharing provisions in the general scheme meet the GDPR standard of necessity and proportionality, or are there areas where the powers drafted are overly broad?

Mr. David Murphy:

We have not identified anything we would consider is in breach of the principles of necessity or proportionality at this time.

William Aird (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Sure. These are quick-fire questions I want to ask. What specific safeguards should be written directly into the legislation rather than left to regularisation or departmental policy to protect citizens' personal data?

Mr. David Murphy:

For the present amendments, it is about ensuring the process fully embeds the requirements of GDPR with regard to consent.

William Aird (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Has the Department adequately justified the scale of personal or financial data processing proposed under the scheme, particularly for fraud prevention purposes?

Mr. David Murphy:

Again, the fraud prevention purposes of the processing of the card are subject to the DPC's inquiry decision, which is before the courts. I cannot comment much more on that.

John Paul O'Shea (Cork North-West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

The Deputy's time is up.

William Aird (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Will we get a second round?

John Paul O'Shea (Cork North-West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Of course. We will move on now to Deputy O'Reilly.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I thank the Cathaoirleach and the witnesses. I have huge concerns, which I have put on the record already, and not just with regard to this legislation. It strikes me that as the DPC has expressed such serious concerns, maybe now is not the time to be adding to legislation and, in fact, now is the time to be pausing to reflect. I know the witnesses have looked for a review, which should happen before we start adding to it. I am conscious that there is an appeal in place. I do not want to cross over that in any way.

I want to ask about the voluntary nature of this. Everybody had a good giggle when the difference between "mandatory" and "compulsory" could not be explained. The free travel pass, for example, cannot be used without the public services card. You cannot access what is a lawful entitlement that a person, in most cases, has worked all their life for, without that card. It is not massive, but it is something for older people and is certainly considered by the Government as a budgetary measure. That is not voluntary; it is compulsory if you want to use that pass. Is that the definition? I struggle with that. If you are an older person and you have a right to access that pass, you should have the right to access to it regardless of whether you choose to share your biometric data or give it into what I am sure people regard as a safe place but may not be a safe place.

Mr. David Murphy:

In response to that, I go back to our findings in 2019 during the first DPC investigation into the public services card. The finding was that there was a legal basis in the Social Welfare Consolidation Act for the Department of Social Protection to mandate the use of the card, but only for transactions with that Department. The key finding of "mandatory" not "compulsory", as the Deputy mentioned, related to whether other public service bodies had an entitlement to require the use of the public services card. The finding was that they did not. In the published position of the DPC and the Department in 2021, it was agreed that only the Department of Social Protection could rely on the public services card as the only method of transacting a service. Other public service bodies may request it but cannot require it as the only one. In our understanding, the ability to require the card is limited to the provision of services directly by the Department of Social Protection, not to other Departments.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

When Mr. Murphy refers to "services", is it possible that the legal basis could extend to accessing social welfare?

Mr. David Murphy:

That is exactly it. The provision of a service transaction-----

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

So, it could.

Mr. David Murphy:

I cannot recall the precise definition of what a "service" is in the Act.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

That is fine. That is deeply concerning. I can tell you that now.

Dr. Farries quoted from the LSE study - I have had some interaction with it - which found that it is difficult to create a national ID system in a way that does not undermine privacy, legality and public trust. What makes it difficult? Have steps been taken by the Irish Government in this instance to ensure the ID system is brought in in a way that does not undermine privacy, legality and public trust?

Dr. Elizabeth Farries:

The principal difficulty here in Ireland is that, from a legality perspective, there is an emphasis on consent. From a policy perspective, we are seeing the slow function creep of the card into a de facto requirement in various areas. If we all get used to having a public services card - indeed, 70% of the population now has one despite the unresolved illegality of its biometric system - that expectation is put into practice in society, irrespective of the data protection laws that we are also good at reading every day. That normalisation of the illegal system is a serious concern. Again, the infrastructure of the card itself is at risk of function creep and expansive use across services, simply by nature of how it is being built. There are protections in place, depending on who is in charge, but as we have seen geopolitically and among our neighbours, those protections can disappear very quickly.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Instead of passing these amendments, would Dr. Farries have a suggestion as to what could be done? Obviously, because there are these amendments, we know that more could be tacked on. What should we be doing to ensure the system functions correctly? I do not want to put words in her mouth, but my understanding of what Dr. Farries said was that if we were trying to get there, we would not start from here and we might be better to go back to the start. Would that be correct?

Dr. Elizabeth Farries:

It would be correct to say that I am perplexed as to why amendments are being passed at this stage, given the system's unresolved legality, rights and discrimination concerns. There are very specific matters before this Government about the base surveillance aspects of the card and the important findings from the Data Protection Commission. Why are these not being attended to in the first instance rather than barriers against this illegal system's use being taken down through head 7?

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Regarding the DPC, the concern is around privacy, data retention and all those things.

I do not mean this disrespectfully to any one individual official working there but, let us be frank, some places have not exactly covered themselves in glory when it comes to handling people's biometric data. It is something that people are getting more concerned about.

The DPC found that there was no legal basis. That is incredibly serious. I question why we are here discussing adding to something when the DPC's position could, on appeal, be upheld. In the event that its position is upheld, what would its advice be to us as a committee and to the Department?

Mr. David Murphy:

If the decision is upheld and there is a finding of unlawful processing of biometric data and related infringements, we would go back to the Department regarding position of the outcome of that inquiry, which was over a nine-month period, and address those discrepancies through legislative and operational amendments.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Was anything done in terms of legislation in the nine months that the DPC gave the Department the last time?

Mr. David Murphy:

No. There has been no legislative amendment. As I mentioned in response to a previous question, there was preliminary engagement but at that point the decision was appealed. There has been nothing further with regard to any consultation on or discussion of amendment of the legislation in relation to biometrics and safety processing. We would expect to be back in that position. We have made it very clear that we are happy within those nine months, or whatever period, to engage with the Department on bringing the legislation into a place that is in compliance with data protection law and the jurisprudence of the High Court, and also to assist in the operationalisation. We are happy to assist with reviewing a data protection impact assessment and getting it to a place of compliance, pending the outcome of the appeal.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I understand that the DPC is working on that and all of that is good, but is there anything else the DPC can do? For example, is there a penalty for the State if that is upheld? Who would it fall to to enforce the penalty? I do not think that there are data protection police, but where would that sit?

Mr. David Murphy:

The DPC has the capacity to fine public bodies. It is more limited than it is for the private sector. I mentioned the Department of Health inquiry where a financial penalty was imposed on the Department.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

How much was that?

Mr. David Murphy:

I think in the region of €29,000 but I am not sure and I could be wrong on that. I do not have the figures. The penalty goes through the courts for collection and ultimately goes back into the Exchequer.

Sarah O'Reilly (Aontú)
Link to this: Individually | In context | Oireachtas source

I will pick up on Dr. Farries's point when she said that the PSC had effectively become mandatory even though it is supposed to be voluntary. Voluntary identity systems can become de facto mandatory when banks, landlords, employers and venues use it. I will ask the question to both bodies. Will they give me examples of where that may have happened? When I was applying to MyGovID, I had to have a public services card. If people want to look into their future pensions, they must be on MyGovID. Effectively, PSCs are mandatory. Have the witnesses any other examples of where that has happened?

Dr. Elizabeth Farries:

I am grateful to the Senator for raising the fact that there is this creeping process where the PSC has effectively become mandatory in practice. While I do not have them on hand, there are numerous media reports from 2016 on of people who were captured by this de facto mandatory piece. We have had reports of pensioners, for example, whom the Government now identifies as a vulnerable population and whom the PSC is intended to protect, being denied their pensions because they did not submit to the scheme. There are examples in the media of Departments that were not authorised to ask for the PSC but nonetheless did. It is that culture of normalisation. Despite the important safeguards put in place by the Data Protection Commission in reference to GDPR, they do not slow the cultural change that sees Ireland looking to the PSC as a national identity card without any of the safeguards that are required for an identity card.

Sarah O'Reilly (Aontú)
Link to this: Individually | In context | Oireachtas source

Does the DPC think that there are enough guarantees to ensure that the digital ID systems will remain genuinely voluntary?

Mr. David Murphy:

I will break it down a couple of ways and refer to my response to Deputy O'Reilly's question. In terms of what we found in 2019, there is a lawful basis for the Minister for Social Protection to issue the card for the purposes of authenticating the identity of a person claiming or presenting for benefits or services directly from the Department of Social Protection, not for other specified bodies and certainly not for third parties. We would hold to that. There is no legal basis for the mandatory requirement of the card by other parties. We would say that the primary safeguard is the legal basis itself, whereby these parties would potentially be in breach of the law and, secondarily, in breach of the GDPR. It can be difficult to enforce in some ways because we are very reliant on individuals making complaints to our office but we engage in the supervisory examination of different sectors. With the landlord sector, we carried out an investigation of the collection of excessive personal data for granting people tenancies. Our safeguards are through the lens of our enforcement of the GDPR.

Sarah O'Reilly (Aontú)
Link to this: Individually | In context | Oireachtas source

I am not putting words in the witnesses' mouths but I am trying to understand what is happening here. Dr. Farries says she cannot understand why something that is illegal, and has been shown to be illegal, is being continued with and that she is against it. At the same time, the witnesses from Data Protection Commission beside her are nodding their heads yet saying something different. Twice Mr. Murphy has said that there should be a comprehensive review but we are still going ahead with these amendments. Why go ahead with them? I feel that Mr. Murphy is really trying to tell us something else, namely, that there should be a comprehensive review. I am getting very mixed messages from the DPC. I know its representatives are here to do their job as such, but I do not feel they believe it. I am not sure. The data broker is a high-profile target. Can the Government be trusted with people's data? That is another question that has to be asked. Does anyone have any comments on that?

Mr. David Murphy:

We are certainly not trying to mislead or give mixed messages. I would break it down into the question marks over the lawfulness of the use of the card, particularly the biometric processing. The DPC has made specific findings that are now subject to appeal in the courts. Once that process has concluded, and should our decision be upheld, we will be moving to see action taken to bring the processing into compliance.

In relation to the current proposed amendments, in our consultative process with the Department we are concerned with the specific lawfulness of the amendments themselves. At this point in time, we are not being asked to question the underpinning legislation, which we have already found fault with. It is clear to us that we have identified issues with the legal basis, which are before the courts. We hold the position that a comprehensive root-and-branch review of the legislation underpinning the public services card is required, given the findings of two inquiry reports by the DPC.

Sarah O'Reilly (Aontú)
Link to this: Individually | In context | Oireachtas source

Would I be right in saying that the DPC is saying we should be starting from scratch?

Mr. David Murphy:

A review of the legislative proposals or the legal basis underpinning the card would certainly be the DPC's position. Having said that, my comments on the current amendments are that the DPC has not identified specific concerns with those specific amendments within the current legal framework but we do think that, given two inquiry decisions by the DPC, a comprehensive review would be beneficial.

Anne Rabbitte (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I thank the witnesses for their opening statements.

I wonder whether we should be having this conversation at all in light of the fact that there is an ongoing live court case. At the same time, we are hearing one side of the story and, I mean no disrespect, we are not hearing the other side of the story. I am wondering if this is the right thing to be doing in light of the fact that there is a live court case that has been ongoing since July 2025, if I am correct.

Mr. David Murphy:

Exactly, yes.

Anne Rabbitte (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

Maybe the secretariat could tell me if we are allowed to comment on this.

John Paul O'Shea (Cork North-West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

That is why Mr. Murphy has been explicit in his responses that he is not commenting on the second judgment. There is judgment there since the previous judgment and, to be fair, that has been very explicit. We are talking about pre-legislative scrutiny on the subject of the Bill, which is the addition of details to the public services card. Members have themselves referred to the matter, which is subject to an appeal. To be fair to everybody here, the witnesses have also said that they cannot comment on it. I urge members to stick with what is on the agenda. We are dealing with pre-legislative scrutiny of the draft heads. I remind members that the legislation has not been published yet, which is why this is pre-legislative scrutiny, so we do not know the full details of it. This is why we have the opportunity as committee members to have this engagement with our witnesses. We heard from witnesses from the Department last week. Today, the questions are for the DPC and our contributor from UCD. If members could stick to that, I would be fierce grateful as chairperson.

Anne Rabbitte (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I hear the Cathaoirleach. I will do my best. I cannot promise.

Dr. Elizabeth Farries:

Privilege permits me to comment on the legality of the public services card on foot of the Data Protection Commission's finding. I believe privilege allows me to say that currently there is an unlawful biometric card in Ireland. The biometric face surveillance process is illegal, so I think it is an important question as to why amendments are in place that further facilitate the widespread dissemination of an illegal facial recognition technology project that has yet to be resolved by the courts. It is a valid question. Why are these amendments being considered at this juncture? Why are the protective gates being opened even further in a way that moves the card from its voluntary status into being a de facto mandatory piece. It does not seem like a cautionary move at this stage.

Anne Rabbitte (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

On that basis, I will not comment any further.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I will stay within the confines of what I think is allowed. There are a number of reasons we cannot have a full and frank conversation. Number one, we have not seen the legislation. I can offer a view that perhaps it is a bit premature to be having this discussion, notwithstanding the fact that the witnesses and members are here. Within the parameters allowed, we will discuss it.

John Paul O'Shea (Cork North-West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

To be fair, we did have a conversation on it and it was agreed by all members that we would have pre-legislative scrutiny of this Bill.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I am not disputing that. I am saying something is happening, outside of this House, that could potentially influence the Bill. Obviously, it is important that we engage in our work. I am very familiar with how pre-legislative scrutiny works. I know we do not see the legislation. That is fine but it hampers us a little bit in terms of what we can say because this all could end up going nowhere.

I go back to the issue of the powers the DPC would have. With respect, a €29,000 fine for the Department for what was a serious enough matter would probably not even cover a couple of seconds of the overrun, never mind the budget. There is not a massive deterrent there. People, including the witnesses, have expressed concerns around the legal basis for this. Citizens have expressed concerns, particularly any citizen who might wish to protect his or her biometric data and also avail of his or her entitlement to a free travel pass. What powers would the DPC have if it was exercising the maximum power that it has?

Mr. David Murphy:

I want to clarify that I am not certain of that figure in the Department of Health inquiry. I do not have the figures in front of me.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

It is not millions. We are talking about thousands anyway.

Mr. David Murphy:

The DPC is limited by the Data Protection Act in the amount that it can fine any public body. It does not extend to the same scope the GDPR allows for private sector bodies, so the scope to levy the types of fines we have seen levied against Meta, Google, etc., is not there. Before we get to administrative fines, the DPC would look at all of the other corrective measures that we have. In the context of public bodies processing personal data, we would see the power to issue a ban on processing and to require the deletion of personal data, which have been implemented in previous decisions, as maybe our primary protection for citizens. Where we make a finding of unlawful processing of personal data, we can require the processing to cease, ban the processing from recommencing and require the data to be deleted. If our decision in this case is upheld, what we will be looking for is for those types of corrective measures to be implemented and for the Department to take the necessary steps to bring the processing of data in the public services card into compliance.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

There is more than a fine available to the DPC.

Mr. David Murphy:

Very much so.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

That is very good. It is also good that we have that information. Has a business case for the collection and retention of this data ever being made? I heard some reference to it possibly assisting the Government in uncovering welfare fraud but my note here tells me that only 48 cases have been identified. That is an awful lot of effort to go to for 48 cases that could have been identified in any event. Has a business case ever been advanced for this card?

Mr. David Murphy:

I reiterate our 2019 findings, which were that in terms of the Department's use of the card, we found that there was a legal basis for the Minister to authenticate the identity of a person claiming, presenting for or receiving benefits and then to use the authenticated identity to process that transaction. Without going into too much detail of the matters before the courts, our most recent inquiry looked at whether there was a legal basis under the law enforcement directive in terms of welfare fraud. We were not of the view that the legislation grounds the processing of personal data for the purposes of fraud detection as a criminal matter.

Dr. Elizabeth Farries:

There is an absence of a lawfulness space but to answer the Deputy's question more directly, no business case has been established on the welfare fraud claims to date.

Louise O'Reilly (Dublin Fingal West, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

It is striking that no business case is being used to any great extent in the detection of fraud and nobody is clamouring for it that I am aware of, yet here we are discussing the expansion of something that could potentially be derailed. Discussion is always good and I thank the Cathaoirleach for facilitating it. I also thank the witnesses for being with us this evening. Hopefully, we will get a chance after the decision to have a deeper conversation on this issue.

Anne Rabbitte (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

Dr. Farries indicated earlier that 70% of the population have availed of public service cards. Did I hear that correctly?

Dr. Elizabeth Farries:

It is the most recent figure before me, as reported in the media.

Anne Rabbitte (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

Dr. Farries then said that at the beginning, people availed of the card or got the opportunity to avail of it and maybe it was not lawful at the start. People are choosing on a voluntary basis to avail of the card.

Could I hear some comments on that? I have gone through Google on all of this. All of the controversies about a public services card, PSC, has been in the public domain since its inception but people are still choosing to use the public services card. Will the witnesses comment on that?

Dr. Elizabeth Farries:

The perspective of my colleagues and under law is that choice is very important here. Consent is the basis for the legality of the card. As I said in my submission, voluntary engagement with the system can become mandatory over time. What some people might sign up to voluntarily suddenly becomes a requirement when they are trying to get access to a certain service and the expectation is that they have the card. I am talking about a normalisation of a specific system that is incredibly risky, is illegal around its biometrics and pushes a pressure towards using it no matter what. I was asked for a number of examples from the media where that voluntariness was not in place, where vulnerable groups have been under pressure to use the card despite not consenting. Head 7, in particular, in my opinion, will further erode the voluntary nature of the card by removing barriers from other Departments and other public services in asking for the card to be presented as well.

Anne Rabbitte (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

Will Dr. Farries expand on the term "non-consenting"?

Dr. Elizabeth Farries:

Consent under the GDPR requires that a person says "Yes" or "No" to the processing of their personal data. However, consent from a policy perspective, as a cultural norm, suddenly sees the requirement for the card everywhere. It is the risk of the erosion of the GDPR protections once everyone begins to expect the use of the public service card as a norm. If we think about it in our personal lives, people might say to themselves, "Sure, I will just the PSC to establish my identity here. I have the card so why would I not?" The Department talks about wanting to make it easier for people who have come to expect that the public services card should be used in this instance but the expectation is the result of the normalised function-creep of what was meant to be a social welfare scheme into all walks of public service life.

Anne Rabbitte (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I will turn that on its head for a second, if Dr. Farries does not mind.

Dr. Elizabeth Farries:

Of course,

Anne Rabbitte (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

We talk about vulnerable groups. In the past, if a person wanted to open a bank account, they had to adhere to anti-money laundering regulations. Many people in vulnerable groups might not have had a driving licence or a passport. They would have to avail of an ML10 form to open an account in a bank, post office or credit once they turned 18 years of age. This would also enable them to avail of their disability allowance, or whatever. That is why I am turning it on its head. All of a sudden there was a standardisation where people did not have to rely on an ML10 form, for which they had to get their photograph taken. The ML10 was only good for that one transaction. It could not be relied on going forward. I would respectfully push back on Dr. Farries in regard to vulnerable groups. For people who did not drive or did not have a passport, there was a choice in terms of them using the public services card, including using it to do everyday banking. They are the same people, believe it or not, who actually have access to travel concessions. It is not like it was forced upon a person. Rather, it met the needs of vulnerable groups.

Mr. David Murphy:

We see the public services card as currently operating in two and now possibly a third tier. The primary purpose of the card issued by the Minister for Social Protection is authenticate and verify the identity of somebody seeking access to benefits from that Department. The secondary tier is those specified bodies in Schedule 12 of the Act, which allows other public bodies to process the personal data on the public services card but not to require it. This goes back to that mandatory-compulsory question. What we are seeing, as the Senator referred to, is this third tier now of the individual being in a position to use this card to verify their identity where they so wish to. What we need to be careful of when we move into that space is that the third party, the bank, is not compelling the production of the card. It should only be where the individual wants to do that. That is where I think Dr. Farries is saying it will get into being mandatory. As the DPC, we would seek to ensure that this does not happen and that the card is only be produced for those purposes, entirely on a voluntary basis.

I refer to the date of birth piece. Let us consider a young person of 19 or 20 years of age looking to enter a licensed premises. Under these provisions, they would be now able to use the public services card with the date of birth, in addition to perhaps a passport or a driving licence, which they may not have access to. From that point of view, we do see the Department's argument that this does bring benefits. Our concern as the DPC is to ensure that those benefits are also ring-fenced by sufficient safeguards to ensure that it is not inappropriately used by those third parties.

In the opening statement I referred to the fact that the DPC's role will be to monitor the use of the card by those third parties to make sure that it is not used for other purposes than simply identifying the person for the purpose for which they have chosen to present the card, whether to open a bank account, to go to the pub, or whatever it may be. To some of those people, it does not make sense to them that they carry an ID that they cannot use for those situations.

Anne Rabbitte (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

That is where the choice-based approach is coming in. I hear what Dr. Farries is saying about the cultural change and the normalisation of it, perhaps, within different sectors of society. An 18-year-old has the opportunity to get a public services card that will also act as an age-ID card and they can put it on the back of their phone. In all fairness, they have had the choice to do.

Dr. Elizabeth Farries:

I will turn the argument on its head one more time. The point around choice is that, for younger people, when banks, landlords, employers and service providers, begin, because of that cultural change, to treat the public services card as the preferred form of identification, then people reaching for alternative, historically appropriate forms of identification might be viewed with suspicion. Alternative forms of ID might be considered burdensome from the perspective of a landlord who might simply say, "No, I just want your PSC, That is what I want. I have 50 applicants before me. You do not have a PSC. There goes that form." The point is the PSC becoming a de facto identity card means that choice is eliminated in these many instances when those safeguards are pulled down and the Department opens up use to other parties outside of social welfare.

Anne Rabbitte (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

In the same vein, if we are talking about landlords and renting and student accommodation or other accommodation, it is part of the RTB and it is part of enrolling and getting one's child student accommodation that the PPS number is produced. If a person is not going to produce the card, they then have to get the letter. Why would we not have universal document on the back of our phones that people could always use? I am not arguing for the sake of arguing. I am just doing it from a completely practical point of view. The 70% or whatever portion of that who avail of the travel are choosing to go that route themselves.

John Paul O'Shea (Cork North-West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

We are out of time. That concludes our questions and answers. I thank the witnesses, Dr. Farries, Ms Burke and Mr. Murphy, for their contributions and for providing the briefing materials in advance of the meeting. It is very much appreciated. It was a constructive discussion and I am sure it will form part of our work as a committee in terms of our discussions of the pre-legislative scrutiny. The meeting now stands adjourned sine die.