Roderic O'Gorman (Dublin West, Green Party)
Link to this: Individually | In context

89. To ask the Minister for Employment Affairs and Social Protection to provide the conclusion of the Data Protection Commission’s investigation into the public services card using facial-matching technology as a means for his Department’s processing of biometric/identity data; the provisions that will be made to bring the scheme into full compliance with GDPR; and if he will make a statement on the matter. [61984/25]

Dara Calleary (Mayo, Fianna Fail)
Link to this: Individually | In context

The SAFE registration process is key to proper authentication of a person's identity. It helps to deter and, where attempted, detect fraudulent presentation of identities for the purpose of accessing public services and funds. It also acts to facilitate easier access to services by enabling people to present proof of identity on a 'once and done' basis rather than having to present such proofs each time they transact with a public body. It is also core to the delivery of secure online services and is key to the implementation of the Connecting Government 2030 strategy, and the implementation in Ireland of the EU Digital agenda including the EIDAS regulation and the EU Digital Wallet. The SAFE process and the use of the PSC was absolutely critical to the rapid rollout of services in response to the Covid epidemic and more recently has proven critical to the allocation of a unique identity, enabling access to public services, for the migrants from Ukraine and other countries.

To date over 4.8 million people have verified their identities using the SAFE process, over 3.2 million of whom use this verified identity to use the Government's online services. There have been no cases of any loss, breach or misuse of data, or of any harm to individuals whose identity has been verified. On the other hand there has been a number of cases of criminals detected and prosecuted for fraudulent presentation of identity. Notably there here has been a decrease in cases of identity related fraud since the roll-out of the process in 2012.

In July 2021, the Data Protection Commission (DPC) commenced an own volition inquiry into the department’s processing of biometric data in connection with the authentication of identity by way of the SAFE Registration process and the issuing of Public Services Cards.

The issue raised by the DPC is not that the biometric process has caused harm or that the technical operation of the process and its security features is in anyway deficient but rather that it does not consider that the department of social protection has an adequate legal basis for the processing of biometric data.

In summary, the DPC acknowledges that the process is provided for in law, but it believes that the law is not transparent or precise enough in its formulation to satisfy GDPR requirements.

Having carefully considered the DPC's decision, and following consultation with the Attorney General's Office, my department believes that there is in fact an adequate legal basis and has appealed the decision on 7th July 2025. This is now a matter for the courts to adjudicate; as it is now before the Courts, it would not be appropriate for me to comment further in that regard.

It is important to note that there are no current implications for users of the SAFE process, the PSC or MyGovID, or anyone wishing to register for, or avail of, these services.

I hope this clarifies the matter for the Deputy.