Announcing that proceedings between it and the department on the matter have been resolved, the Data Protection Commission (DPC) said at least one other option must now be provided in any case where an individual is required to verify their identity before accessing public services.

The Public Services Card was first introduced in 2011 to tackle welfare fraud and was gradually rolled out to access other services, including obtaining a passport and voter registration.

In 2017, the DPC launched an investigation into the use of the card following complaints from civil liberties groups and other non-governmental organisations.

That probe subsequently found there was no basis in law for public bodies to require individuals to possess a card in order to access certain public services and the DPC issued an enforcement notice to the department.

However, the department disagreed with aspects of the findings and appealed the decision.

In a statement today, the DPC said those proceedings had now been resolved, which it said it welcomed.

“In particular, it welcomes the fact that significantly enhanced levels of information are now being provided to citizens to explain (amongst other things) what personal data is processed when an individual applies for a PSC, how it is processed, and to what end, with further enhancements to follow on the basis of additional engagement between the parties,” it said.

“The DPC also welcomes the department’s acknowledgment that, in the absence of legislation making specific provision for this, other public sector bodies cannot compel any individual to acquire a PSC as a precondition to the provision of access to public services.

“To that end, at least one other option must now be provided in any case where an individual is required to verify their identity before accessing public services.”

The DPC added that significant adjustments are also to be made to the department’s approach to the retention of applicants’ personal information.

In a statement also welcoming the breakthrough, the department said that under the agreement it can continue to process personal data to authenticate a person’s identity and issue them with a PSC, which can be used for the purposes of accessing public services provided by the department and those provided by other public bodies.

“It is also acknowledged and accepted that the department and other specified bodies can continue to use MyGovID as the sole means of authenticating identity for the purpose of accessing online services, provided that an alternative service channel is available,” it added.

“The department has undertaken to work with the DPC to develop an agreed programme of work to ensure that any non-public service identity data that may be collected during a SAFE registration is permanently deleted or irreversibly redacted.”

Minister for Social Protection Heather Humphreys said she was pleased the matter has been resolved.

“Given the high level of PSC/MyGovID take-up, today’s agreement is good news both for our citizens and public service providers,” she said.

“Most importantly, the agreement means that members of the public can continue to apply for their Public Services Card for the purposes of transacting with Government Departments, which has proven extremely useful given the increased online interaction during Covid.”

However, while these particular issues have been resolved, separate proceedings being taken by the DPC into the department’s use of biometric facial templates by facial matching software used during the PSC registration process is continuing.