Olga Cronin

A data protection impact assessment (DPIA) of a facial matching software upgrade for the PSC in 2021 failed to identify any legal basis under Article 9 GDPR for the creation of a biometric photo and template database of 3.2 million cardholders.

The DPIA also acknowledges a breach of transparency as individuals were not given information on the legal basis of processing at the time of PSC biometric photo data collection, and identifies a risk that sensitive personal data is being held for longer than necessary or lawful.

The 68-page document was obtained under FOI legislation by ICCL and Digital Rights Ireland (DRI).

The DPIA indicates the Department has built a national biometric database of 3.2 million cardholders’ unique facial features since 2013, including, in some cases, those of children. It also indicates that the Department is intent on retaining each cardholder’s biometric data for their individual lifetime plus 10 years.

Olga Cronin, surveillance and human rights policy officer at ICCL, said: “The Department has been building a national biometric database without a relevant legal basis and without transparency. It continues to collect people’s biometric information in exchange for services they are legally entitled to.

“This must stop. This processing is unnecessary, disproportionate, and presents a risk to people’s fundamental rights.”

Antoin O Lachtnain, director of Digital Rights Ireland, added: “The Data Protection Commission has been investigating the biometric element of the PSC for a number of years now. This DPIA document must be in its possession as part of that investigation. Given its legal failings, the DPC must publish its findings as soon as possible.”