Departement of Social Security
€550,000
Insufficient legal basis for data processing
決定日
2025年6月12日
権威
Data Protection Authority of Ireland
IE
セクター
Public Sector and Education
国名
IE
法律
GDPRステータス
FINAL説明
The Irish DPA imposed a fine of EUR 550,000 on the Departement of Social Security. The controller uses the so called SAFE 2 registration process for anyone applying for a Public Services Card. The SAFE 2 registration, which is mandatory, processes biometric data without a sufficient legal basis. The controller also failed to adequately inform data subjects in regards to the processing and to conduct a data protection impact assessment.
法的引用
Art. 5 (1)Art. 6 (1)Art. 9 (1)Art. 13 (1)Art. 13 (2)Art. 35 (VII)
問題と違反
Insufficient legal basis for data processing