Catherine Murphy (Kildare North, Social Democrats)
Link to this: Individually | In context | Oireachtas source

706. To ask the Minister for Employment Affairs and Social Protection the way in which the privacy notice on her Department's website was changed on 6 July 2018; the person or persons that agreed to the change; the way in which special category data will be processed; the reason the online wording of the privacy notice was changed a number of times on the morning of 6 July 2018; and if she will make a statement on the matter. [32254/18]

Regina Doherty (Meath East, Fine Gael)
Link to this: Individually | In context | Oireachtas source

The Press Office in my Department was contacted by a journalist last week to point out that the Department’s GDPR privacy statement appeared to contradict the Department’s position that photographs collected as part of the SAFE2 registration process are not biometric.

It was pointed out in the press query that my Department’s position is that it does not collect biometric data from customers as part of the SAFE process but that the Privacy Statement indicated that ‘special categories of personal data’ including biometric data are also required to be collected at times.

Examples given in the Privacy Statement of these special categories included biometric data used for the purpose of identification. Biometric data is a valid example of a special category of data, as defined under Article 9 of the GDPR.

However, on review, officials in my Department took the view that the Privacy Statement should be amended to remove anything that may create confusion, especially in relation to the SAFE process and the collection and use of photographs for the Public Service Cards.

Accordingly, on Friday last, a decision was made to amend one line of my Department’s Privacy Statement to clarify the position in relation to the collection of photographs for the purpose of establishing identity. Photographs do not, of themselves, constitute biometric data (they are simply JPEG images) and it was inaccurate to suggest that the photographs were biometric.

The relevant section of the Privacy Statement now simply states that at times we need to collect data such as photographs used for the purpose of identification.

With regard to your question of how special category data is processed special categories of personal data are according to the GDPR “data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited”. The GPPR is also clear that the photographs should not systematically be considered to be special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. The collection and printing of a simple JPEG image on the Public Service Card (PSC) does not therefore constitute the collection or processing of special category data.

I wish to be clear however that these photographs are, in addition to being printed on the PSC, processed, in a separate process, via facial imaging software to create an arithmetic template which is used to detect potential identity fraud. This arithmetic template is not stored on the Public Services Card, does not form part of the public service identity set, and is not shared with any other third party. Further information on the Department’s processing of photographs to detect identity fraud is available at psc.gov.ie/faqwd/where-is-the-biometric-or-arithmetic-template-of-the-photograph-stored-and-who-has-access-to-it/