# Departement of Social Security: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Data Protection Authority of Ireland
- Date: 2025-06-12
- Original: https://www.enforcementtracker.com/ETid-2657
- Canonical: https://overview.legal/posts/48772
- Topics: DPIA, Privacy Impact Assessment, Special Categories of Data, Biometric Data, Types of Special Categories of Personal Data, Personal Data, Biometric Data, Education, Public Authority, Controllers

## Summary

The Irish DPA imposed a fine of EUR 550,000 on the Departement of Social Security. The controller uses the so called SAFE 2 registration process for anyone applying for a Public Services Card. The SAFE 2 registration, which is mandatory, processes biometric data without a sufficient legal basis. The controller also failed to adequately inform data subjects in regards to the processing and to conduct a data protection impact assessment.

## Full text

The Irish DPA imposed a fine of EUR 550,000 on the Departement of Social Security. The controller uses the so called SAFE 2 registration process for anyone applying for a Public Services Card. The SAFE 2 registration, which is mandatory, processes biometric data without a sufficient legal basis. The controller also failed to adequately inform data subjects in regards to the processing and to conduct a data protection impact assessment.

GDPR Articles: Art. 5 (1) a), e) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 13 (1) c) GDPR, Art. 13 (2) a) GDPR, Art. 35 (VII) b), c) GDPR
Industry: Public Sector and Education

---
Generated by overview.legal · https://overview.legal/posts/48772 · 2026-08-22