ARTICLE · 21 AUGUST 2019

Non-Compliance Of Public Services Card Scheme With Data Protection Law

Mason Hayes & Curran LLP

Contributor

Mason Hayes & Curran LLP

Managing Partner: Will Carmody Chair: Philip Nolan Number of partners: 124 Languages: French,...

View firm profile

Explore more from Mason Hayes & Curran LLP

The Irish Data Protection Commission (DPC) has published a statement regarding its investigation into certain aspects of the Public Services Card (PSC) scheme run by the Department of Employment Affairs and Social...

IrelandPrivacy

Author LinkedIn connections

The Irish Data Protection Commission (DPC) has published a statement regarding its investigation into certain aspects of the Public Services Card (PSC) scheme run by the Department of Employment Affairs and Social Protection (Department). The statement levies heavy criticism at the Department and the PSC scheme regarding how it dealt with the personal data of millions of citizens in Ireland. The DPC requires the Department to implement substantial changes to remedy the situation.

DPC FINDINGS

The DPC’s statement focuses on its findings of non-compliance of the PSC scheme with data protection law in two key areas:

The legal basis on which the personal data of individuals is processed, and

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

Related Articles

The Data Protection Commission’s 2026 AI Insight Report

DPC AI Insights Report: Key Takeaways

High Court Judgment On GDPR Representative Actions

William Fry LLP

Corporate Update October 2026 - Listed Companies

European UnionPrivacy

Horizon Scanner Finance October 2026 - European Developments

European UnionPrivacy

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Privacy
- Data Protection

Related Comparative Guides

Comparative Guide

Data Protection & Cybersecurity

See more popular content from

PrivacyMason Hayes & Curran LLP

Verify, Guarantee, Demonstrate: The TikTok Decision And What It Means For International Data Transfers

The Irish High Court has delivered a landmark judgment in TikTok's appeal against the Data Protection Commission's €530 million fine, establishing that organizations must not only identify appropriate transfer...

European UnionPrivacy

The Data Protection Commission’s 2025 Annual Report

Ireland's Data Protection Commission received a record 16,160 new cases in 2025, marking a 45% increase from the previous year, while imposing over €530 million in administrative fines. The Commission finalized four major inquiries, with the TikTok decision accounting for €530 million of the total penalties, and concluded 208 cross-border complaints as Lead Supervisory Authority.

The Data Act – “Access By Design” Requirement Comes Into Force

The European Union's Data Act introduces a groundbreaking "access by design" requirement that fundamentally changes how manufacturers must approach product development for connected devices and IoT products. From September 2026, businesses placing connected products on the EU market must ensure users can directly access their generated data by default, shifting data accessibility from a reactive request-based model to a proactive design imperative.

Corporate Update October 2026 - Sustainability Reporting & ESG

This privacy statement outlines how cookies are used on this website and provides users with options to manage their cookie preferences. By accepting all cookies, users consent to analytics and targeting cookies being deployed on their device.

Part 2: AI Act Articles 50(3) And 50(4) Transparency Obligations

The European Commission has issued interpretive guidelines on Article 50 of the AI Act, clarifying transparency obligations for emotion recognition systems, biometric categorization, and deepfake content.

William Fry LLP

The Data Act – Part I: Key Considerations Regarding Data Access And Sharing

The EU Data Act, which became applicable on 12 September 2025, fundamentally reshapes how businesses handle data generated by connected devices and related services. With Ireland's General Scheme published in February 2026 designating ComReg and CCPC as enforcement authorities, companies must now assess their compliance obligations across data sharing frameworks, contractual terms, and user access rights or face significant fines.

The Data Act: “Access By Design” Requirement Comes Into Force For Medical Devices

The Data Act's "access by design" requirement came into force on 12 September 2026, mandating that manufacturers of connected products and providers of related services must enable direct user access to generated data by default. This article examines the scope of this new obligation and its practical implications for businesses in the Life Sciences sector, particularly those developing medical devices and Internet of Things products.

EDPB 2025 Annual Report: Recent Trends

The European Data Protection Board's 2025 Annual Report reveals significant developments in EU data protection enforcement and regulatory cooperation. With approximately €1.15 billion...

McCann FitzGerald LLP

EU Digital Omnibus Regulations – What Has Been Proposed?

On 19 November 2025, the European Commission published its draft Digital Omnibus Regulations (EU Regulations 2025/0360 and 2025/0359).

European UnionPrivacy

DPC AI Insights Report: Key Takeaways

Ireland's Data Protection Commission has published a comprehensive report examining its supervisory engagement with organizations developing AI products between 2021 and 2025, revealing a tenfold increase in AI-related engagements and highlighting critical compliance areas including lawful basis, transparency, and children's data protection. The report provides detailed insights into the DPC's quasi-regulatory sandbox approach and outlines key observations on data protection obligations for AI technologies,

Registration Portal Opens For Beneficial Owners Of ICAVs, Unit Trusts And Credit Unions

The Central Bank of Ireland has established a portal that allows Certain Financial Vehicles, namely Irish Collective Asset-Management Vehicles, unit trusts and credit unions, to register details of their beneficial owners ...

IrelandWealth Management

Mason Hayes & Curran LLP

Who ‘Owns’ An Employer’s Contacts? New Judgment Provides Clarification

Contacts and connections are a key asset for many businesses, particularly those in the B2B space.

IrelandMedia, Telecoms, IT, Entertainment

Mason Hayes & Curran LLP

Hedge Funds In Ireland

Over the last 25 years, Ireland has earned a reputation as a leading domicile for internationally focussed regulated investment funds.

IrelandStrategy

Mason Hayes & Curran LLP

Court Of Justice Rules That Hyperlinking Internet Content Is Not Copyright Infringement

In a much anticipated judgment, the Court of Justice of the European Union yesterday in "Svensson v Retriever Sverige AB" held that hyperlinking freely available Internet content on another website does not amount to an unlawful "communication to the public".

European UnionIntellectual Property

Mason Hayes & Curran LLP

Croke Park Agreement

The Department of the Environment, Community and Local Government has published its Action Plan under the Croke Park Public Sector Agreement for the local authority sector.

IrelandStrategy

Mason Hayes & Curran LLP

EU General Court Finds In Favour Of Monster In Energy Drink Trade Mark Dispute

Unleash the Beast! Monster Energy has successfully invalidated a copycat trade mark registration in the EU for INSOMNIA ENERGY protecting energy drinks. Our Intellectual Property team considers the key takeaways for brand owners.

European UnionIntellectual Property

Mason Hayes & Curran LLP

How The Regulation Of The Dot IE Domain Led To Success For Irish Business

Anyone who has attempted to register a .com for their organisation knows that the good ones are taken.

IrelandMedia, Telecoms, IT, Entertainment

Mason Hayes & Curran LLP

AI And Automated Decisions: GDPR And The Evolving Decision-Making Process

Broadly speaking, artificial intelligence (AI) is the term given to the ability of computer software to simulate human cognition,...

Mason Hayes & Curran LLP

General Data Protection Regulation: 6 Things You Need To Know

The General Data Protection Regulation will come into effect two years after it is published in the Official Journal of the EU.

Mason Hayes & Curran LLP

Platform To Business Regulation Comes Into Effect - But What Does It Mean For ECommerce?

The Platform to Business Regulation (2019/1150) (‘P2B Regulation') addresses the perceived imbalance between online platform providers and traders, as well as between online search engines ...

IrelandConsumer Protection

Mason Hayes & Curran LLP