Agreement between the Department of Social Protection and the Data Protection Commission

Background

In August 2019, the Data Protection Commission issued a Report on SAFE Registration and the Public Services Card (PSC). The Department of Social Protection did not agree with the adverse findings contained in the Report. In December 2019, the Data Protection Commission (DPC) issued an Enforcement Notice to the Department in respect of the findings contained in that Report.

The Department filed an appeal against the Enforcement Notice, as provided for under data protection legislation.

The appeal was due before the Court on 7 December 2021.

The Department and the DPC agreed a settlement and, on the basis of the matters agreed, the DPC has cancelled the Enforcement Notice.

Key Points

The Agreement acknowledges that the Department of Social Protection can continue to process personal data as is necessary and proportionate in order to authenticate a person’s identity and issue them with a PSC which can be used for the purposes of accessing public services.

The DPC has already found that social welfare legislation provides a legal basis for the requirement that customers of the Department authenticate their identity by way of SAFE registration. The Agreement acknowledges that other public bodies listed in social welfare legislation (“specified bodies”) may use the PSC as a means of verifying the identity of the people they deal with, provided that they also accept other methods of authenticating identity.

The Agreement also acknowledges and accepts that the Department and other specified bodies can continue to use MyGovID as the sole means of authenticating identity for the purpose of accessing online services, provided that an alternative service channel is made available.

The Department and the DPC have agreed to work together on the development and implementation of a programme of work in relation to data retention and transparency.

As part of the Agreement, the Department is publishing a Notification document, which has been agreed with the DPC, together with the August 2019 DPC Report (which was originally published on the Department’s website in September 2019).

Both documents are available to download below.