The DPC ruling on the PSC, explained
In August 2019 the Data Protection Commission published its Final Investigation Report on the Department of Social Protection's processing of personal data in connection with the Public Services Card. The report was 154 pages. Most coverage at the time focused on the political confrontation that followed. This page is a plain-English summary of what the DPC actually found — and what has and has not happened since.
The eight findings, in plain English
| # | Finding | What it meant |
|---|---|---|
| 1 | The Department was lawfully processing PSC data for the purposes set out in social-welfare legislation. | Using PSC to administer welfare payments is fine. |
| 2 | The Department was not lawfully processing PSC data when it required PSC as a precondition for services unrelated to social welfare. | Requiring PSC to access a driving licence, a passport-card application, or any other non-welfare service had no lawful basis. |
| 3 | The retention of identity-related personal data — including documents submitted during SAFE registration — was excessive, not justified by a clear legal basis, and breached the data-minimisation principle. | The Department held data indefinitely when it shouldn't have. |
| 4 | The transparency of the SAFE registration process was inadequate; citizens were not properly informed about what data was being collected, by whom, and for what purposes. | The privacy notices and consent processes were not GDPR-grade. |
| 5 | The Department's general approach treated the lawful-basis question as if it had been settled by the original 2011 legislation, when in fact subsequent extensions of PSC use required separate lawful basis analysis. | Each new use case needed its own GDPR justification; none was provided. |
| 6 | Some elements of the data architecture — including how PPS number data was linked across services — created risks of unauthorised secondary use. | Identifier linkability introduced surveillance risks that hadn't been properly assessed. |
| 7 | The Department's response to the inquiry was characterised by an unwillingness to accept the regulator's role. | The DPC noted, in unusually direct language, that the Department resisted the inquiry. |
| 8 | Specific actions were ordered: cease using PSC as a precondition for non-welfare services; delete unlawfully retained data; revise transparency notices; complete proper Data Protection Impact Assessments. | This was the enforceable bit. |
What the Department did
The immediate political response was outright rejection. The then Minister for Employment Affairs and Social Protection publicly stated that the Department would not implement the findings and would continue to require PSC for the affected services. The Department appealed the subsequent enforcement notice to the Circuit Court.
The substantive picture over the following years is more nuanced:
- The Department continued to require PSC for several non-welfare services. Alternative routes were quietly added for some (SUSI applications), but not consistently across the board.
- Retention practices were tightened. The most egregious indefinite-retention practices were reduced.
- SAFE registration transparency was improved; the privacy notices are now closer to GDPR-grade, though not universally regarded as adequate.
- Data Protection Impact Assessments for new PSC-adjacent processes were produced.
The Circuit Court judgment, in 60 seconds
The Circuit Court's 2021 judgment turned on procedural questions: whether the DPC's enforcement notice was properly served, whether the scope of the appeal was correctly framed, whether certain remedies were within the court's jurisdiction. The substantive question — whether the Department's processing of PSC data was lawful for non-welfare services — was not the central focus of the judgment. The Department's procedural arguments were partially successful; the underlying DPC finding of unlawfulness was not overturned at the substantive level.
This is why public coverage of the case sometimes describes the Department as "winning" the appeal, while the DPC and civil-society organisations describe the substantive findings as having "stood". Both descriptions are partially correct.
What the DPC has said since
The DPC has continued to assert the substance of its findings. In subsequent annual reports the regulator has noted that the 2019 conclusions remain in force where the Department has not adequately addressed them. The DPC has also raised concerns about the 2026 Bill expanding PSC use.
The current DPC position can be summarised as: the 2019 findings are still good law; some have been substantively addressed by the Department, others have not; the proposed expansion under the 2026 Bill makes the unresolved issues more acute, not less.
What ICCL and DRI have said since
The civil-society groups treat the 2019 findings as the canonical statement of what is wrong with the PSC regime, and they cite them whenever new expansion is proposed. Their argument is that the Department's response has been incremental compliance on the easier findings while ignoring the harder ones — and that the 2026 Bill compounds the unresolved issues.
What this means for you
If you are a Public Services Card holder:
- Your card and the data behind it are still lawful for welfare purposes.
- For most non-welfare services, alternative identity routes have been added — but PSC is usually the easiest.
- You retain your GDPR rights: you can file a subject access request to see what data the Department holds about you (see our forthcoming SAR template), and you can complain to the DPC if you believe a processing operation is unlawful.
Primary sources
- DPC Final Investigation Report on the Public Services Card (2019) — published in full on dataprotection.ie.
- DPC enforcement notice and follow-up correspondence.
- Circuit Court judgment (2021) — available on courts.ie.
- Department of Social Protection responses — gov.ie.
- ICCL and DRI submissions and analysis — iccl.ie, digitalrights.ie.