DSP Challenges DPC Fine on Biometric Data: Legal Battle Intensifies

Published Date : 7/10/2025 

Ireland's Department of Social Protection (DSP) is fighting a 550,000 euro fine from the Data Protection Commission (DPC) over its use of face biometrics for Social Protection Cards, arguing the process is legally justified under GDPR. 

The Department of Social Protection (DSP) in Ireland is locked in a legal showdown with the Data Protection Commission (DPC), challenging a ruling that deemed its use of face biometrics for Social Protection Card applications unlawful. The dispute centers on the SAFE 2 registration process, which collects biometric facial templates for identity verification. The DPC, citing violations of the General Data Protection Regulation (GDPR), imposed a hefty fine and ordered the DSP to halt biometric data processing within nine months unless it can justify the practice legally. Despite the deadline, the DSP has opted to contest the decision in court, claiming its actions comply with data protection laws. n n nThe DPC's investigation, initiated in 2021, concluded that the DSP lacked a valid legal basis for collecting biometric data, a critical requirement under GDPR. The commission’s decision, which carries a 550,000 euro penalty, highlights concerns about transparency and compliance. The DSP, however, maintains that its use of face biometrics is necessary for secure identification and that it adheres to legal standards. A spokesperson for the department stated, 

Frequently Asked Questions (FAQS): 

Q: Why is the DSP challenging the DPC's fine?

A: The DSP claims its use of face biometrics for Social Protection Cards complies with data protection laws and believes the DPC's ruling lacks sufficient legal basis.

Q: What is the SAFE 2 process?

A: The SAFE 2 registration process involves collecting biometric facial templates to verify identities when applying for a Social Protection Card.

Q: What are the risks of using face biometrics?

A: Biometric data can be misused if not properly secured, leading to privacy breaches and long-term risks for individuals.

Q: What did the DPC accuse the DSP of?

A: The DPC alleged the DSP violated GDPR by lacking a valid legal basis for collecting biometric data and failing to address compliance deficiencies.

Q: What could happen if the DSP loses the case?

A: The DSP would need to stop processing biometric data within nine months or face further penalties, potentially impacting its ability to issue Social Protection Cards efficiently. 

More Related Topics :