The data protection watchdog had concluded in August 2019 that there was no legal basis for requiring the PSC to access many public services which required it. The DPC issued an enforcement notice to the Department in December that year.

The Department filed an appeal against the enforcement notice, which was due to be heard in court last week, but the Department and the DPC have now agreed a settlement out of court.

Under the agreement:

• it is acknowledged that the Department of Social Protection can continue to process personal data to authenticate a person’s identity and issue them with a PSC, which can be used for the purposes of accessing public services, both those provided by the department and those provided by other public bodies;

• it is also acknowledged and accepted that the Department and other specified bodies can continue to use MyGovID as the sole means of authenticating identity for the purpose of accessing online services, provided that an alternative service channel is available;

• the Department has undertaken to work with the DPC to develop an agreed programme of work to ensure that any non-public service identity data that may be collected during a SAFE registration is permanently deleted or irreversibly redacted. In addition, the Department has undertaken to make some changes to its privacy statement as requested by the DPC

Consequent on the agreement, the DPC has withdrawn its enforcement notice and the Department has withdrawn its appeal.

Heather Humphreys, minister for social protection, said: “I am very pleased that this matter has been resolved. Given the high level of PSC/MyGovID take-up, today’s agreement is good news both for our citizens and public service providers.

“Most importantly, the agreement means that members of the public can continue to apply for their Public Services Card for the purposes of transacting with government departments, which has proven extremely useful given the increased online interaction during Covid-19.

“My Department looks forward to working constructively with the DPC to ensure the data protection rights of our citizens are fully protected.”