Ireland’s Data Protection Commission (DPC) has fined the Department of Social Protection (DSP) €550,000 for unlawfully processing biometric data as part of its Public Services Card (PSC) SAFE 2 registration program. The decision represents a significant intervention in the regulation of biometric data use by public institutions and raises broader questions about the legal frameworks underpinning digital identity systems.
DPC Finds Multiple GDPR Breaches in SAFE 2 Process
The fine follows an in-depth investigation into the SAFE 2 registration process, which requires individuals to submit facial biometric data in order to access public services. The program has resulted in the collection and storage of biometric data from approximately 70 percent of the Irish population. The DPC concluded that the DSP failed to demonstrate a clear and legally sufficient basis for processing this sensitive category of personal data under the General Data Protection Regulation (GDPR).
“The rollout of Safe 2 registration has resulted in the ongoing collection, storage and processing of highly sensitive personal data, including biometric data consisting of facial templates, on a large scale by the DSP,” stated the DPC in its decision. The Commission emphasized that biometric data, due to its uniquely identifying nature, requires a high standard of legal clarity and justification for processing.
The regulator also issued a formal reprimand and ordered the DSP to cease processing biometric data associated with SAFE 2 within nine months unless it can establish a valid legal basis that meets GDPR requirements. The order underscores the DPC’s view that current legislation does not provide the necessary specificity or safeguards.
DSP Responds as European Oversight Grows
The DSP has defended its approach, stating that it believes existing legal provisions support the SAFE 2 process. However, the department acknowledged the regulator’s concerns. “We note that the DPC decision does not find that there is no legal provision but that the legal provision that exists is not, in its view, clear and precise enough to satisfy the requirements of the GDPR,” a DSP spokesperson said in response to the ruling.
DPC Deputy Commissioner Graham Doyle elaborated on the inquiry’s scope: “This inquiry was concerned with assessing whether the legislative framework presently in place for SAFE 2 registration complies with the requirements of data protection law and whether the DSP operates SAFE 2 registration in a data protection-compliant manner, and the findings announced today identify a number of deficiencies in this regard.”
The case reflects a broader European trend toward heightened scrutiny of biometric data use by public agencies. Regulatory bodies across the EU are ramping up oversight of facial recognition and identity verification systems to ensure compliance with privacy laws, particularly as digital identity programs expand and intersect with public services.
Sources: MLex, Data Protection Commission, Irish Examiner
–
By the ID Tech Editorial Team
