THE IMPORTANCE OF facial recognition is emphasised a number of times in circulars and training documents issued to civil servants on the Public Services Card over the years.
The documents also outline the options for “voice biometrics” during the verification process for the card.
Documents released to the organisation Right to Know, and seen by TheJournal.ie, delve into how central the verification process for a Public Services Card is to the way the department of Employment Affairs and Social Protection works. This department deals with services such as social welfare and benefits.
Since 2011, 3.2 Public Services Card have been issued.
Following the latest controversy surrounding the card, solicitor and Right to Know activist Fred Logue told TheJournal.ie he believes that these documents show an explicit admission that biometric data is processed for the card. He said that dismantling the PSC would be a “very costly process” due to how central the card is to the way the department works.
The Public Services Card was thrust into the spotlight earlier this month, when the Data Protection Commissioner completed its landmark report into the legality of the card.
It found no legal basis for the PSC to be required to access State services other than social welfare and benefits. It also found that the department has no lawful basis for retaining all of the supporting documentation it collects after it has verified a person’s identity through its Safe process and issued a PSC.
Furthermore, the government’s transparency with the public on the issues surrounding the PSC was also criticised.
The government has so far refused to publish the report, and said it will only do so “once full consideration is complete”.
The Data Protection Commissioner is not yet finished with its probe into the PSC, with the next phase of its investigation to look at the issue of biometric processing.
“Identity verification”
Part of a presentation on the Public Services Card refers to the principles of the department’s Safe registration. Safe consists of a number of layers of identity verification. You must satisfy the requirements for Safe 2 to get a PSC.
The principles of Safe refer to a “single set of rules for establishing and authenticating identity across the public service” and for the process to “issue an identity token – the PSC”.
Logue said that the distinction is important here between “identity verification” and “proof that your identity has been verified”. These documents, he suggested, show that the PSC is about the latter, placing it as an identity card.
As far back as 2009, two years before the first PSC was issued, the Data Protection Commissioner had highlighted fears that the PSC could become a de-facto national ID card.
Another worrying aspect, according to Logue, was highlighted in a circular supplied to civil servants in September 2018.
It says: “PPS Number allocation includes a Safe registration to Safe level 2 as part of the allocation process, part of which is the capture of a photograph and signature.
Facial image matching software is then used to compare photographs captured against all other photographs held on file.
Logue says he believes that “this is an explicit statement that they’re doing biometric processing”. However the Government has repeatedly denied that the process for the PSC card involves biometric processing.
Regina Doherty told the Dáil in March that the PSC “does not store the biometric or arithmetic template of [a] photograph”.
A sample profile in the department’s database lists a number of details about the person who is registered, including the supporting documents they have given. Also included in the list is an option for a “voice biometric”.
In a recent case in the UK, the HM Revenue and Customs were told to delete voice recordings of five million taxpayers after failing to get explicit consent from people before signing them up to the voice ID system for telephone inquiries, the BBC reported.
TheJournal.ie has asked the department if it obtains voice biometrics from any individual engaged in the Safe process.
“The Department of Employment Affairs and Social Protection has never obtained voice biometrics for any individual engaged in the SAFE registration process. The Department has no plans to do so in the future,” a spokesperson said.
The government has repeatedly said that no biometric data is processed for the PSC.
Minister Doherty said in March: “While the PSC does store a person’s photograph, it does not store the biometric or arithmetic template of that photograph. The collection and printing of a simple JPEG image on the PSC does not, therefore, constitute the collection or processing of special category data, as set out in the GDPR.
To be clear, the photograph in addition to being printed on the PSC, is processed, in a separate process, via facial imaging software to create an arithmetic template which is used to detect potential identity fraud. This arithmetic template is not stored on the PSC, does not form part of the public service identity set and is not shared with any other third party.
‘No reference to adoption’
TheJournal.ie has highlighted a number of instances where people who were adopted had difficulty when trying to obtain a PSC.
One woman described how she was told she’d have to produce her adoption cert if she wanted to continue with the application process. “I felt so humiliated,” she said. “I just burst into tears.”
According to the September 2018 circular, staff should not mention adoption to someone in the course of their application.
It says: “In most cases, an officer will not be aware that the person is adopted. When a person produces a certificate, the certificate should be accepted unless the officer has doubts as to its authenticity. No reference to adoption should be made by the officer.”
The internal systems also allow for civil servants to check if a driving licence has been issued for a person by their PPS number.
Using that checker, there is also an option for “welfare”, “HSE” and “agriculture”. However it is not clear at this point what information these options provide to the user of the system.
Date of birth option
The documents also note how in the next iteration of the PSC due to be implemented this year, “one of the changes will be that a customer will have the option of having their date of birth displayed on their PSC”. Up to now, it has not been an option to have your date of birth on the card.
Data Protection Commissioner Helen Dixon told TheJournal.ie that provisions such as this show how it’s worth having a debate around the PSC as it has expanded over the years.
“There is at least one bill at 2017 … that’s still going through the houses of the Oireachtas, amongst other provisions, and would allow for an individual to produce their public services cards to a private sector entity, and specifically in the context of using it as an age card,” she said.
Because if you think about this, for so long [...] it’s been specifically argued about this card is this is limited as an enabler and a gateway to accessing specifically public services. And to start expanding it out where it can be accepted by private sector entities and used beyond the availing of public services is a very… is a very big step.
Embedded
The documents you provide when getting a PSC can range widely from your photograph to a utility bill to a copy of your passport.
In a training manual for the Safe registration process issued in March 2013, it outlines the plethora of data the department would have been given from individuals applying for the card.
The Data Protection Commissioner has found that there is no lawful basis for the retention of this data, and has given the government six weeks to provide an implementation plan for this finding.
Late last week, Minister Doherty said that she and her department took the findings of the latest report “very seriously” and are giving “very careful consideration to those findings”.
Logue said: “For me these documents reveal how central facial recognition is to the PSC, and how integrated the PSC is to their processes.
Dismantling the PSC would be a costly process, potentially more than the €62 million already spent on it. And if the Data Protection Commissioner said to stop processing them, it has the potential to disrupt the welfare system.
The department does have a choice now. It can begin a managed retreat on the PSC or they could ramp up their activities with it.
To embed this post, copy the code below on your site
have your say