Joe O'Brien

The NGO has criticised the decision in the Data Protection Commission’s (DPC) inquiry into the Department of Social Protection as “more than a decade late and inadequate”.

The DPC yesterday imposed a €550,000 fine on the Department for breaches of the GDPR relating to the requirement for public services card (PSC) applicants to provide their biometric data, namely facial templates.

ICCL welcomed the findings but said the DPC had failed to take decisive action by giving the Department nine months to identify a valid lawful basis for processing the biometric data.

Joe O’Brien, ICCL’s executive director, said: “For many years, ICCL and our colleagues at Digital Rights Ireland have argued that the PSC’s mandatory use of facial recognition technology is unlawful.

“This is a partial win for the privacy and data protection rights of people living in Ireland. It confirms what we have advocated for, for many years — that the public services card, which was estimated to have cost the State €100 million, trespassed upon human rights and infringed EU and Irish law.

“The DPC decision is over a decade late and does not go far enough.

“The Department effectively created a de facto national biometric ID system by stealth over 15-plus years without a proper legal foundation. This illegal database of millions of Irish people’s biometric data must be deleted.”

Olga Cronin, senior policy officer at ICCL, added: “The Department unlawfully forced vulnerable people to give it their biometric data before it would help them. It demanded data from people who needed its help to put food on the table.

“We should not have to trade our biometric data to access essential services to which we are already legally entitled.”