Department of Social Protection

Background This own-volition inquiry, which commended in July 2021, follows a prior DPC investigation into certain aspects of the DSP’s processing of personal data in connection with the issuance of PSCs. That investigation resulted in legal proceedings, in which the DSP appealed an Enforcement Notice issued by the DPC, which were subsequently withdrawn. A joint agreement between the DPC and the DSP as well as the final investigation report from that inquiry were published in December 2021 . The final investigation report stated that processing of personal data, including biometric data, by the DSP in respect of SAFE 2 registration was to be addressed separately by the DPC. The current inquiry was established to separately examine the processing of biometric data under SAFE 2 registration, as highlighted in the final investigation report. Rationale for the Inquiry SAFE 2 registration is mandatory for applicants seeking a PSC, which is required to access a range of DSP services, including welfare payments. Individuals who do not undergo SAFE 2 registration are unable to access these services. The process involves the collection, storage, and processing of biometric data, specifically facial templates, in relation to a substantial proportion of the population of the State. As biometric data is classified as special category data under the GDPR, it attracts enhanced protections and safeguards. Given the nature and scale of the processing, the DPC considered that it was essential for the DSP to have a clear and precise legal basis for this processing, accompanied by appropriate safeguards to protect personal data and the fundamental rights of individuals.