Public Service Card or Digital ID?

One State body has issued a fine to another over use of Biometric ID

“Whether or not the PSC is required by law is immaterial if you cannot function in society without it” - TJ McIntyre, Irish Independent, Aug 30 2017.

The government has been slapped with a record €550,000 fine over the Public Service Card, the Examiner reports today.

Cianán Brennan, reporter at the Irish Examiner has done stellar work on this story, a complex tale concerning a legal battle between the Data Protection Commision (DPC) and the State - specifically the Department of Social Protection.

The most important take-away from today’s story is this line:

“It remains unclear what will happen next. However, if the Government accepts the report, it will finally need to introduce specific legislation through the Oireachtas to legalize the PSC.”

The issue concerns biometric data - which refers to any information that can identify a person by their physical characteristics — for example, via a fingerprint.

In the case of the Department of Social Protection, the PSC uses a photograph. The Department refuses access to Social Welfare payments for anyone that refuses the card.

Here’s Cianan Brennan’s report published in today’s Irish Examiner.

“The Data Protection Commission has hit the State with a €550,000 fine, the largest GDPR penalty for a public body, for processing people’s biometric data without a legal basis via the Public Services Card.

The DPC said that the Government must now discontinue processing such data using the PSC within 9 months unless it can find a legal basis for doing so.

The State has long denied that the PSC uses biometric data, despite a person’s photograph appearing on every version of the card. It has instead argued that it creates an "arithmetic template" from the photo for processing purposes — a method it claims does not constitute biometric data.”

The final two paragraphs explain of the Irish Examiner report reveal what has been actually been achieved here:

“While the conclusions of the biometric investigation are not surprising, today’s publication comes nearly six years later than anticipated.

The PSC is now used daily by millions of Irish citizens—not just for receiving welfare payments, but also for services such as renewing driving licences and accessing the National Childcare Scheme.”

The PSC card story harks back to an embarrassing moment for then Minister for Social Protection Regina Doherty, who was ridiculed for stating it would be ‘mandatory but not compulsory’ in 2017.

In an Irish Independent article dated Aug 30 2017, writer TJ McIntyre pointed out that there has never been any real reason to introduce the PSC card, which prompts the question, what is this all about?

McIntyre wrote:

“What is the justification for the PSC? Remarkably, there has never been a clear rationale. In a damning 2016 report the Comptroller and Auditor General found that there was "no business case" for the PSC and no adequate assessment of the costs and risks associated with it.”

His last point is crucial in understanding how the State implements such infrastructure upon the people. In choosing the Department of Social Welfare as the method by which to implement the controversial card, the State targeted the cohort of citizens least likely to kick up a fuss because they are dependent on said State - that being, those on Social Welfare.

“Whether or not the PSC is required by law is immaterial if you cannot function in society without it,” McIntyre wrote.

The Irish Council for Civil Liberties - which took a case against the Department of Social Protection over its use of biometric data - published this statement today:

After 15 years, the Irish Council for Civil Liberties (ICCL) partially welcomes the Data Protection Commission’s (DPC) findings today that collection of facial (biometric) data for the Public Services Card (PSC) is unlawful. However, the decision is more than a decade late and inadequate.

The decision vindicates the actions taken by ICCL and Digital Rights Ireland against the Department of Employment and Social Protection (DEASP). The Government had previously claimed that the facial records were not biometric data. Today, the DPC found that the Department unlawfully collected facial records (biometric data) from 70% of the population of Ireland over 15 years.

In addition, the Department failed to tell people why it was collecting their facial records and whether it was legal. Confirming our position for over a decade and a half about the poor data protection standards of the PSC project, the DPC today confirmed ICCL’s previous reporting that the Department failed to conduct a proper Data Protection Impact Assessment.

However, the DPC has failed to take decisive action today. Instead, it has fined the DEASP €550,000 and ordered it to stop processing the biometric data within 9 months if it cannot identify a valid lawful basis.

The ICCL is demanding immediate deletion of the illegal facial data database. It further calls on the Department and the DPC to explain to the Oireachtas and the public how this system was permitted to operate unlawfully for so long.

I asked Chat GPT for it’s input on the situation, specifically, if the Department of Social Welfare broke the law by making the PSC card mandatory for social welfare recipients. Here’s the reply:

The noteworthy detail here is that in December 2021, a pre-trial agreement paved the way for the use of the PSC in relation to the collection of social welfare. Chat GPT helpfully sets out the current situation, which echoes the Examiner reporter’s tweet.

Specific legislation will be required for the use of the PSC card across further services.

Readers, I am interested in your stories, have you declined or refused the PSC card and what consequences did you face?

Read Cianán Brennan’s article in the Irish Examiner here

Read the ICCL statement here

Read TJ McIntyre’s Irish Independent article here

Thanks to those supporting this Substack - buy the author a coffee here