June 12 2025 – After 15 years, the Irish Council for Civil Liberties (ICCL) partially welcomes the Data Protection Commission’s (DPC) findings today that collection of facial (biometric) data for the Public Services Card (PSC) is unlawful. However, the decision is more than a decade late and inadequate.  

The decision vindicates the actions taken by ICCL and Digital Rights Ireland against the Department of Employment and Social Protection (DEASP). The Government had previously claimed that the facial records were not biometric data. Today, the DPC found that the Department unlawfully collected facial records (biometric data) from 70% of the population of Ireland over 15 years.  

In addition, the Department failed to tell people why it was collecting their facial records and whether it was legal. Confirming our position for over a decade and a half about the poor data protection standards of the PSC project, the DPC today confirmed ICCL’s previous reporting that the Department failed to conduct a proper Data Protection Impact Assessment.  

However, the DPC has failed to take decisive action today. Instead, it has fined the DEASP €550,000 and ordered it to stop processing the biometric data within 9 months if it cannot identify a valid lawful basis.  

After 15 years this is not enough. ICCL insists on the immediate deletion of the illegal facial data database. The Department and the DPC must also explain to the Oireachtas and the public how this system was permitted to operate unlawfully for so long.  

Executive Director of ICCL Joe O’Brien said:  

“For many years, ICCL and our colleagues at Digital Rights Ireland have argued that the PSC’s mandatory use of facial recognition technology is unlawful. 

“This is a partial win for the privacy and data protection rights of people living in Ireland. It confirms what we have advocated for, for many years - that the Public Services Card, which was estimated to have cost the State €100 million, trespassed upon human rights and infringed EU and Irish law.  

“The DPC decision is over a decade late and does not go far enough. The Department effectively created a de facto national biometric ID system by stealth over 15-plus years without a proper legal foundation. This illegal database of millions of Irish people’s biometric data must be deleted.” 

Olga Cronin, Senior Policy Officer at ICCL, said:  

“The Department unlawfully forced vulnerable people to give it their biometric data before it would help them. It demanded data from people who needed its help to put food on the table. We should not have to trade our biometric data to access essential services to which we are already legally entitled”.

Today’s announcement also vindicates the decisions of many individuals who personally suffered after they took a stance against the unlawful collection of their biometric data and refused to hand it over. This included a woman who was denied a pension, a teacher who was denied benefits after breaking her ankle, and a firefighter who was denied a passport.

Today’s findings follow an earlier decision by the DPC that public sector bodies, other than the DEASP, could not make the PSC a precondition of accessing public services. Alternative means to provide proof of identity must be accepted and those alternatives may be online or offline.  

Note to editors 

The DPC’s findings are that the Department  

1. Unlawfully collected facial records (biometric data) from 70% of the population of Ireland over 15 years
2. Held those data unlawfully
3. Failed to tell Public Services Card users why it was collecting their facial records, or to show whether it was legal 
4. Failed to carry out an adequate Data Protection Impact Assessment by failing to assess the necessity and proportionality of the facial data collection and failing to assess the risks to the rights and freedoms of PSC users

Timeline: Public Services Card  

2000:

A Public Services Card is proposed. ICCL demands safeguards.  

2009: 

In December 2009, the Department of Social Protection entered into a contract with a supplier at a fixed price of €19.7million plus 21% VAT to produce 3 million PSCs by end of 2013 - 2,095,000 standard cards and 905,000 free travel variant cards. 

2011: 

In 2011, the PSC and the purported role it could play in terms of cracking down on ‘welfare fraud’ gained new momentum due to the recession, Troika loans and emphasis on austerity measures. By the end of the year around 4,000 PSCs are issued in Ireland.  

2012:

In April, the Department awards a contract for facial matching software, worth almost €213,000, to 3M Ireland Ltd.  
 
The Social Welfare and Pensions Bill 2012 is introduced in April. During debate on that Bill, the then Minister for Social Protection, Joan Burton, assures TDs that facial records will not be mandatory.  

At the Bill’s committee stage, the Minister introduced 23 pages of amendments to the Bill including provisions about the PSC. Opposition TD complained that the amendments were provided only at midnight the previous night and had no time to review them. The Bill is passed. 

By May 7,000 PSCs have been issued. 100,000 people have completed the SAFE registration process required for getting a PSC by the end of the year.  

2014:

The Department’s 2013 annual report announces it used facial image matching software to help detect and deter duplicate registrations for the PSC. It also states that a number of suspected cases of identity fraud have been referred to the Department’s Special Investigation Unit for further investigation.  

2015:

The Department’s 2014 annual report says that “facial matching software has been in use since March 2013”. 

In July, the Department launches mygovid.ie which allows people to register for access to the Department and other government online services, including an appointment to register for a PSC.  

There are around 1,750,000 PSCs in circulation by the end of 2015.  

2016:  
The Office of the Comptroller and Auditor General’s 2015 annual report states the PSC project failed to develop a business case when the Government took steps in 2004 and 2005 to roll it out.  

In 2016, it became necessary for all first-time passport applicants aged 18 and over, and resident in Ireland, to present a PSC when making their application.  

By June 2016, millions of PSC cards had been produced (2.06 million comprising 1.37 million standard cards and 693,000 free travel variants). Only 1.2 million (58%) standard cards had been activated.   

2017:  

It was confirmed in May that anyone applying for a passport or driving licence in the future would need a PSC. RSA also announced (on May 5, 2017) that from June 1, theory test candidates would need a PSC to book their theory test and that the PSC would be an ID requirement at the centres from June 17 onwards.  

In August, stories emerge about difficulties people encounter when assessing welfare benefits and services. The Irish Times reports about a woman, in her 70s, whose non-contributory pension was stopped after she refused to register for the PSC. The Department owed her €13,000 but refused to pay her even though she offered to identify herself by other means. The Journal reports that a 29-year-old man with Down syndrome received a letter in which he was requested to attend an appointed time to register for the PSC which would replace his travel pass. The following day, the Minister for Social Protection Regina Doherty told Newstalk the PSC was “not compulsory but is mandatory” to claim social welfare benefits.  

The Data Protection Commission issued a public statement on the controversy in August and said there was a pressing need for updated, clearer and more detailed information to be communicated to the public and service users regarding the mandatory use of the PSC for accessing public services. The commissioner asked the Department to publish a comprehensive FAQ. This was eventually published in October 2017. In the same month, the DPC Helen Dixon launched a formal inquiry into the PSC.  

2018:  

ICCL and Digital Rights Ireland appear before the Joint Committee on Employment Affairs and Social Protection in February for what was the first specific and widely publicised debate in respect of the legislation regarding the PSC project.  

2019: 

The DPC published its findings in August, which the State appeals to the Circuit Court.  

In October, Martin McMahon made a complaint to the DPC accusing the Department of Social Protection of engaging in “mass surveillance” with regard to the collation of data from the free travel pass variant of the PSC. He alleged an excessive collection of personal data by the Department when people used the PSC as a free travel pass.  

Fieldwork begins on the first Data Protection Impact Assessment of the PSC for the Department of Social Protection (this is completed in July 2021).  

2020:  

UN Special Rapporteur on Extreme Poverty and Human Rights Professor Philip Alston writes a letter to the Irish Government about the PSC, saying his analysis found that the PSC discriminates against the marginalised without a clear legal basis. ICCL provided a briefing on this letter to Oireachtas members.  

2021:  

The DPC launches a new investigation into the Department of Public Expenditure’s (DPER) use of the PSC in August, following a complaint from DRI. The complaint alleges that the database underpinning the PSC was unlawfully made available to DPER and is being used by DPER in a manner that is not consistent with data protection rights.  

In December, the Department of Employment and Social Protection withdraws its appeal in the Circuit Court, and finally acknowledges that other public sector bodies cannot compel individuals to get a PSC as a precondition to access public services. Alternative means to provide proof of identity must be accepted and those alternatives may be online or offline.  

2023:  

In a written response to a parliamentary question from Social Democrats TD Catherine Murphy in April, Minister Heather Humphreys clarifies the Government’s position, and acknowledges biometrics are used, but claims they are not stored on the PSC or shared with any other public body. 

In May it emerges that the Department of Education has started mandating teachers to get a PSC in order to receive a new digital payslip.  

Also in May, the Data Protection Commission (DPC) finds that the Department of Social Protection infringed the GDPR by failing to notify Martin McMahon when he received his PSC that in its use as a Free Travel Pass, personal data could be transferred to the Department of Social Protection.  

ICCL obtains the 2021 data protection impact assessment (DPIA) of the facial matching system, in May. It confirms there is no lawful basis for the collection of biometrics about 2.3 million card holders, and that people are not informed about the data use.  

ENDS

For media queries: Ruth McCourt, ruth.mccourt@iccl.ie / molly.kavanagh@iccl.ie / 087 415 7162