DPC concludes inquiry into Department of Social Protection's facial biometric processing for SAFE 2 registration (dataprotection.ie)

• DPC finds DSP violated GDPR in processing facial biometrics for PSC registration
• €550,000 fine and order to stop processing unless lawful basis found within nine months
• Inquiry began in July 2021; security measures found adequate

"The Irish Data Protection Commission (DPC) has completed an inquiry into the Department of Social Protection's (DSP) processing of facial biometric data as part of SAFE 2 registration for the Public Services Card (PSC). The DPC found the DSP lacked a valid lawful basis for collection, failed transparency obligations, and had an inadequate Data Protection Impact Assessment. It imposed a €550,000 fine and ordered cessation of processing within nine months unless a lawful basis is identified."