Irish DPC fines Department of Social Protection €550,000 over biometric data processing in SAFE 2 registration (dataprotection.ie)

• DPC found DSP violated GDPR articles 5, 6, 9, 13, and 35.
• €550,000 fine imposed on Department of Social Protection.
• Processing of biometric data must stop within 9 months unless legal basis is established.

"The Irish Data Protection Commission (DPC) has concluded its investigation into the Department of Social Protection's use of facial matching technology for the Public Services Card. The DSP was reprimanded and fined €550,000 for GDPR violations, including lack of lawful basis for collecting biometric data and inadequate transparency. The DSP must cease processing within 9 months unless a valid legal basis is established."