Sanction RGPD Data Protection Authority of Ireland — Departement of Social Security : 550 k€ (2025)
- Autorité de contrôle
- Data Protection Authority of Ireland
- Pays
- Irlande
- Entreprise / secteur
- Departement of Social Security
- Montant de l'amende
- 550 k€
- Date de la décision
- 12 juin 2025
- Fondement juridique
- Art. 5 (1) a), e), Art. 6 (1), Art. 9 (1), Art. 13 (1) c), Art. 13 (2) a), Art. 35 (VII) b), c)
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Irish DPA imposed a fine of EUR 550,000 on the Departement of Social Security. The controller uses the so called SAFE 2 registration process for anyone applying for a Public Services Card. The SAFE 2 registration, which is mandatory, processes biometric data without a sufficient legal basis. The controller also failed to adequately inform data subjects in regards to the processing and to conduct a data protection impact assessment.