Cathy Bennett (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context

130. To ask the Minister for Employment Affairs and Social Protection the amount of expenditure to date regarding the creation and operation of the Public Services Card; the amount expended in relation to regulatory and legal challenges regarding the card; if he accepts that the card records biometric data; and if he will make a statement on the matter. [33202/25]

Dara Calleary (Mayo, Fianna Fail)
Link to this: Individually | In context

The Public Services Card (PSC) was provided for in legislation in 1998 when it was introduced alongside the PPS Number to replace the previous Revenue and Social Insurance number (RSI) and the Social Service Card (SSC). The most recent detailed cost benefit analysis, which was completed in 2021 showed, at that time and taking account of administrative as well as control savings, that the SAFE process had delivered benefits of about €218m as against costs of €98m and projected an NPV out to 2030, on a conservative basis, of at least €206m. Costs arising from regulatory and legal challenges relating to the Public Services Card are not borne by my Department but are instead carried by the Office of the Attorney General and the Chief State Solicitor’s Office.My Department received a copy of the Data Protection Commission’s (DPC) final decision on the processing of biometric templates in connection with the SAFE registration process on 9th June 2025. The Deputy should be aware that the biometric template created by my Department, as part of the SAFE identity authentication process, is not stored on an individual’s PSC and is not shared with any other Department or organisation. The data is stored only on a secure database and is used only by my Department’s facial matching system. It should be noted that the DPC did not find any evidence of inadequate technical and organisational security measures and that there are no examples of any person suffering damage or loss as a result of SAFE registration. The DPC decision does not find that there is no legal provision for the processing involved but that the legal provision that exists is not, in its view, clear and precise enough to satisfy the requirements of GDPR. The DPC decision allows the Department nine months to identify a valid legal basis. The decision therefore has no immediate implications for the processing of this data, or for users of the PSC or MyGovID or anyone wishing to, register or avail of, these services in the next nine months.My Department is carefully considering the DPC's decision report in conjunction with colleagues in the Attorney General's Office with a view to determining an appropriate response within the nine month timeframe provided for in the decision. I hope this clarifies the matter for the Deputy.