What happened
It was reported in the decision by Ireland’s Data Protection Commission (DPC), the country’s privacy regulator, that people applying for a Public Services Card must complete an identity registration process called SAFE 2. The card is required to access a range of the Department’s services, including welfare payments. The Department’s guidance warned that failing to complete registration when asked could mean a new welfare claim was refused or an existing payment withdrawn.
During registration, a photograph is taken of the person’s face. Software converts the image into a biometric template, a numerical representation of the face. According to the decision, the system compares that template against every other template held by the Department to identify people who may have registered under another identity. Staff review possible matches. The software was supplied by Thales, formerly Gemalto.
The decision records that by September 2021, the Department held photographs and biometric templates for 3,488,101 people. Each template was kept for the person’s lifetime plus ten years.
The DPC found that the Department:
- failed to identify a valid lawful basis for collecting biometric data, in breach of Articles 5(1)(a), 6(1) and 9(1) of the GDPR
- as a result, unlawfully kept that biometric data, in breach of Article 5(1)(e)
- did not give people sufficiently transparent information about the registration process, in breach of Articles 13(1)(c) and 13(2)(a)
- left required details out of its Data Protection Impact Assessment, in breach of Articles 35(7)(b) and (c)
The DPC reprimanded the Department and fined it 550,000 euros. It also ordered the Department to stop processing biometric data for SAFE 2 registration within nine months unless it could identify a valid lawful basis.
What an auditable version would have shown
According to the decision, the Department relied on several sections of the Social Welfare Consolidation Act 2005 to justify its use of facial matching. The DPC found that none mentioned biometric processing. The law allowed the Minister to take photographs to confirm identity, but left the method to the Minister’s discretion and set no limits on when biometric processing could be used.
The DPC said facial matching was intrusive and required a particularly precise legal basis. It found that the Department had no clear, precise and foreseeable legal basis for the processing. It also found the Department had not shown why collecting and comparing the biometric data of virtually everyone applying for a card was necessary or proportionate.
The Department argued that the processing was intended to fight fraud and should fall under separate law-enforcement rules. The DPC rejected that argument. It found that the matching was used to verify identity when issuing a card, not as part of a criminal investigation.
A useful record would have linked each use of a person’s biometric data to the specific legal power allowing it. It would also have recorded what the person had been told about that use. The DPC found that the legislation relied on by the Department did not mention biometric processing.
Where the gap was
According to the decision, the facial matching system often needed staff to review its results. The Department’s figures showed that 35% of new registrations were referred for human review. For renewals, the figure was 95% because the match score was too low, even though the system was comparing a new photograph with an earlier photograph of the same person.
The DPC observed that these renewal comparisons should have produced high scores if the system was working as intended. The Department disagreed that the referral rate showed a failure. It said the high rate demonstrated its commitment to using biometric processing properly and that it would review its thresholds.
The decision records that between May 2018 and March 2022, 73 suspected identity fraud cases were referred to the Department’s Special Investigations Unit after human review. During the same period, 20 criminal convictions for identity fraud arose from the biometric processing.
This was not the first investigation into the Public Services Card. The decision records that the DPC had previously issued an enforcement notice. The Department appealed it before withdrawing the appeal as part of a settlement.
The Department argued that the earlier investigation had accepted the legal basis for registration. The DPC rejected this. It said the earlier investigation had expressly left biometric processing to be examined separately.
The DPC also noted two limits to its findings. They did not challenge SAFE 2 registration as a policy, and it found no evidence that the Department’s security measures for the biometric data were inadequate.
A ConductRecord is designed to record what processing took place, the authority relied on and the reason for it. This would allow the legal basis for each action to be checked rather than assumed.
ConductRecord is a Headlights design.
What governance should have looked like
According to the decision, the DPC found that the Department had not established a valid lawful basis for the biometric processing used in SAFE 2 registration.
The Department has appealed the decision to the High Court. A spokesperson said the Department believed its processing complied with data protection law. The Department said it appealed after consulting the Office of the Attorney General. As of October 2026, the sources reviewed do not show the outcome of the appeal.
The Department also told the DPC that the facial matching software provider named in the decision was no longer its current provider.
Best practice would be to establish the specific legal basis before collecting biometric data, particularly when access to essential public services depends on providing it. People should be told clearly what information is collected, how it is used and why. The organisation should also complete an impact assessment that meets the legal requirements.
Failure Pattern: a government department made facial biometric processing a condition of accessing welfare services. The regulator found that the law relied on did not provide a valid basis for that processing. The decision is under appeal.
Governance Principle: an organisation that requires biometric data to provide a service should be able to identify the specific legal power allowing its use and demonstrate what people were told about that processing.
The reference implementation of ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- Inquiry concerning the Department of Social Protection (Data Protection Commission, decision dated 9 June 2025)
- Final decision, IN-21-7-3 (Data Protection Commission, PDF)
- Department of Social Protection to fight GDPR ruling in court (Irish Legal News)