€210k to be spent on technical support for public services card

Heather Humphreys, the social protection minister: Department has not contacted data protection commissioner about contract.  Picture:Gareth Chaney/Collins

The Department of Employment Affairs and Social Protection is to spend €210,000 on technical support  for  its Standard Authentication Framework Environment (SAFE) programme, the administrative system behind the controversial public services card (PSC).

The three-year contract concerns expert opinion on the smart-card technology. The previous contract is due to expire in the coming months, said Heather Humphreys, the social protection minister.

Despite the  PSC project being the subject of a court challenge by the department against the Data Protection Commission (DPC), the DPC had not been informed that the contract was to be renewed, Ms Humphreys said.

“My department has not engaged with the data protection commissioner with regard to this procurement, as it relates to the ongoing, day-to-day operations of the department, and nor has the DPC made any request to the department in respect of this procurement exercise,” the minister said, in response to a parliamentary question tabled by Social Democrats co-leader, Catherine Murphy.

The SAFE authentication system is a government-created standard of verifying identity for welfare applications.

After concern was expressed by the DPC regarding the PSC framework, the Department of Social Protection compiled a  guide to the system in October 2017. 

The DPC subsequently launched a two-year investigation into the legality of the card, with the final report published in August 2019.

That report concluded that the PSC is illegal when applied to services other than that of its parent department, and mandated that 3.2m, historic records held on card applicants be destroyed.

Last December, the department was served with an enforcement notice by the DPC, regarding that report. In response, it filed a challenge to the commissioner, Helen Dixon’s findings, in the circuit court, later that month. That matter remains before the courts.

Meanwhile,  no provisional report regarding the PSC’s alleged biometric nature has yet to be received by the department, despite the fact that report —  the second half of the overall PSC investigation — had been slated for publication before the end of 2019 by the DPC.

Biometrics relate to physical or behavioural characteristics that can be used to digitally identify an individual, by fingerprint or facial recognition, for example. 

Under the General Data Protection Regulation (GDPR), such information qualifies as special category data and requires a specific legal basis for its compilation, something critics of the PSC claim does not exist.

The department has denied that the PSC has any biometric characteristics.