Social protection minister takes legal action against Data Protection Commission

A spokesperson for the Data Protection Commission said that the regulator is not “in a position to comment as the matter is now before the courts”. Picture: Brian Lawless/PA

The Department of Social Protection has initiated a legal action against the Data Protection Commission after the regulator ordered the Government to stop processing biometric data via its public services card. 

Papers were lodged in the High Court on Monday by the minister for social protection Dara Calleary for a miscellaneous common law application against the Data Protection Commission. The minister is represented by the Chief State Solicitor’s Office.

It is understood the action relates directly to the Data Protection Commission order against the department confirmed last month, which was delivered along with a €550,000 fine.

It is not as yet known what the nature of the application is, given legal challenges to decisions by State agencies or bodies are typically delivered via an application for judicial review.

The department of social protection had not replied to a request for comment at the time of publication.

A spokesperson for the Data Protection Commission said that the regulator is not “in a position to comment as the matter is now before the courts”.

Last month’s decision related to an investigation into the alleged biometric nature of the public services card — the welfare-benefits card which can also be used to access separate State services, including the National Childcare Scheme and driver licence renewals.

Biometric data refers to any information that can identify a person by their physical characteristics — via a fingerprint for instance or, in this case, a photograph.

The commission found the card violated GDPR by failing to identify a legal basis for processing biometric data, retaining that data without justification, and not ensuring sufficient transparency about how the data would be used during registration.

The commission also ruled that the Government must discontinue processing such biometric data using the public services card within nine months of the decision unless it can identify a legal basis for doing so.

It is not the first time the department has taken the legal objection route with the Data Protection Commission in light of adverse decisions regarding the card.

In August 2019, the commission ruled that the State had no lawful basis for making the public services card — originally conceived in the 2000s as a welfare benefits card only by the department of social protection — mandatory for all public services.

That decision led to a prolonged legal battle between the State and one of its own regulators. The dispute ended in a December 2021 settlement, with the commission's  findings left unchallenged but with the State continuing with the public services card project — albeit without mandatory requirements.