Gerald Nash (Louth, Labour)
Link to this: Individually | In context

424. To ask the Minister for Public Expenditure and Reform if he is concerned at the Data Protection Commissioner’s (DPC) ruling of June 2025 (details supplied) specifically in respect of the DPC’s finding and fine against the Department of Social Protection, regarding issues connected to the identification of a valid lawful basis for the Department’s processing of biometric data in connection with the registration of new public service cards; the requirement to cease processing of such data within 9 months (in the absence of the Department of Social Protection identifying such a valid lawful basis for the processing of such data); the work his Department has done with the Department of Social Protection since the ruling in order to address the issues identified; and if he will make a statement on the matter. [61915/25]

Jack Chambers (Dublin West, Fianna Fail)
Link to this: Individually | In context

The SAFE registration process, carried out by the Department of Social Protection, is key to proper authentication of a person's identity. It helps to deter and, where attempted, detect fraudulent presentation of identities for the purpose of accessing public services and funds.

It also acts to facilitate easier access to services by enabling people to present proof of identity on a 'once and done' basis rather than having to present such proofs each time they transact with a public body. It is also core to the delivery of secure online public services and is key to the implementation of the Connecting Government 2030 strategy, and the implementation in Ireland of the EU Digital agenda including the EIDAS regulation and the EU Digital Wallet.

In July 2021, the Data Protection Commission (DPC) commenced an own volition inquiry into the Department of Social Protection’s processing of biometric data in connection with the SAFE registration process and the issuing of Public Services Cards (PSC). The Department of Social Protection received a copy of the DPC's decision on 9th June 2025. In summary, the DPC acknowledges that the process is provided for in law, but it believes that the law is not transparent or precise enough in its formulation to satisfy GDPR requirements.

I am advised that following careful consideration by the Department of Social Protection, and consultation with the Attorney General's Office, the Department of Social Protection decided to appeal the DPC decision on 7th July 2025.

As the matter is now a matter for the courts to adjudicate, it would not be appropriate for me to make any comment.