PSC Questions shapes

  • General
  • Security
  • Registration
  • Benefits
  • Legal
Expand All | Collapse All
  • 1. What is SAFE registration?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    SAFE registration is the process used by the Department of Employment Affairs and Social Protection to establish and verify a person’s identity so that it can be sure that –

    1. the person using its service is the person they claim to be
    2. hat nobody else is using that person’s identity for the purpose of claiming a payment or service,
    3. that the person is not claiming another payment or using another service under a different identity and in addition,
    4. to minimise the requirement for people to provide the same identity information over and over again when accessing different services

    The acronym SAFE stands for ‘Standard Authentication Framework Environment’. It is a standard for establishing and verifying an individual’s identity for the purposes of accessing public services which was agreed by the Government in 2005.

     

    This SAFE standard has four levels:

    SAFE 0 = No assurance of identity

    SAFE 1 = Balance of probabilities (the minimum authentication level for the allocation of a PPS Number)

    SAFE 2 = Substantial assurance (the minimum authentication level for issuing a Public Services Card)

    SAFE 3 = Beyond reasonable doubt (typically by use of technology such as fingerprinting)

    The Department of Employment Affairs and Social Protection is implementing SAFE 2 registration on a phased basis with its customers and customers of other public services that require identity verification to a substantial level of assurance.

  • 2. Do I have to have a Public Services Card to access a service or be paid a benefit?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Department of Employment Affairs and Social Protection makes it clear to customers in receipt of welfare payments or entitlements that they do need to register to SAFE 2, in accordance with the relevant legislative provisions, to access or to continue to access those payments/entitlements. Once a customer completes the SAFE 2 registration process, they may be issued with a Public Services Card (PSC). The PSC is replacing older documents used to show entitlement to a benefit, including the social welfare services card and the paper travel pass. Accordingly it will in future be necessary to produce a PSC as proof of identity for certain types of transactions, including collecting welfare payments in cash at post offices and availing of free travel on public transport.

  • 3. How frequently will an individual be required to update their data for SAFE? e.g. photograph?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    A person is only required to undertake a SAFE 2 registration process once.

    However the information verified during this process may need to be updated if a person’s circumstances change. Possible changes to PSI data include change of their name (e.g. on marriage), address, nationality (e.g. on naturalisation), sex (e.g. gender re-assignment).

    The Public Services Card that is issued on completion of SAFE registration is valid for up to 7 years. At renewal a new photograph is taken to update the new card
    and the PSI dataset.

    New Public Services Cards may also be required when a person’s status changes, e.g., a person reaching the age of 66 will be automatically issued with a new card with the ‘free travel’ functionality, enabling them to avail of free travel on public transport services.

    Lost cards are replaced using the current elements of the PSI dataset (including photo) and will ordinarily remain valid for the validity period of the original card.

  • 4. If I leave Ireland and emigrate permanently, can I request my SAFE registration be cancelled and deleted (i.e. exercise a Right to be Forgotten)?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    A SAFE registration is verification of a person’s identity and of their Public Service Identity dataset. Such details are relevant for potential future claims or entitlements (as are details of social insurance contributions made etc.) and for the continued security of the person’s identity (to prevent it being used fraudulently). Consequently, these details cannot be deleted. This is consistent with current data protection legislation and will, from May 2018, be compliant with Article 17 3(b) of the General Data Protection Regulation.

     

  • 5. Is the PSC an identity card?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Public Services Card is not a national ID card as it does not bear the characteristics of such a card. For example, it isn’t compulsory for a person to have one simply by virtue of being resident in the State (which it would be if it was a National ID). Most countries with a national ID card require people to carry it with them (in some cases at all times) – there is no such law in Ireland compelling people to carry the Public Services Card.

    Equally, it cannot be requested by any public or private body or person not included as a specified body in Schedule 5 of the Social Welfare Consolidation Act 2005 (as amended). In many countries operating a national ID card, private bodies are required by law to check a person’s identity through their national ID card before providing them with service, particularly in financial and insurance sectors. By contrast, the PSC can only be used by public bodies specified in the legislation and their agents in the context of conducting a public transaction with the person concerned. Therefore, the legislation narrows its application considerably and proves that the intent of the card has always been limited to the provision of public services.

  • 6. What is MyGovID and am I legally required to have a MyGovID account?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    A MyGovID account is a secure online account for accessing public services. The process for registering and using a MyGovID account proves in the online environment that the person has had their identity verified to the SAFE 2 standard. By using what is known as two factor authentication linked to the SAFE registration process MyGovID assures the privacy and security of online services. For example, people registered with a MyGovID account can request online access to their PRSI contribution record or can apply online for some welfare services. It is not mandatory for people to use these online services, it is an optional benefit provided to people who are registered to SAFE 2 level. A full description of MyGovID is available on the dedicated website www.mygovid.ie.

    In addition, the MyGovID secure online identity verification system is also essential for Ireland to be aligned with the EU eIDAS regulation, which is a key aspect of the EU’s eGovernment Action Plan and Digital Single Market Strategy. See Why do I need a PSC for MyGovID if my physical card is not read as part of the process of registration? also for more information on MyGovID.

  • 7. Must the PSC be carried at all times by individuals in the State and/or can any member of An Garda Síochána ask that the card be produced?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    It is not necessary to carry a Public Service Card at all times.

    An Garda Síochána is not a specified body under the Social Welfare Consolidation Act 2005 (as amended) – except in respect of its own members – and consequently cannot request the card from a person. In fact, it would be an offence for a member of An Garda Síochána to request a person’s PSC under Section 263 (4) of the Social Welfare Consolidation Act 2005 (as amended).

  • 8. Who is responsible for identity services and standards in the public service?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The SAFE standard, including the PSC and MyGovID platforms, are overseen and managed by a senior level Interdepartmental Implementation and Policy Group on Public Service Identity which is co-chaired by the Department of Public Expenditure and Reform and the Department of Employment Affairs and Social Protection. This group reports to the Civil Service Management Board. All decisions are subject to Government approval, and if required, to legislative change.

  • 9. Is it intended to increase the scope of the card beyond the Schedule 5 bodies as outlined in the legislation?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    At this time there are no plans to expand the range of specified bodies. Any increase in the number of specified bodies would have to be provided for in legislation and consequently would have to undergo Oireachtas scrutiny prior to enactment.

    One of the provisions set out in Section 5 of the Social Welfare, Pensions, and Civil Registration Bill 2017 would, if enacted, enable customers to volunteer their PSC where they wish to use it as a form of proof of identity and/or age. However, it is important to note that it would remain an offence for a non-specified body or person to request or demand the production of a PSC, or to access data held on the PSC. The proposed legislation would not change the number of specified bodies that can request the PSC. It would simply give individuals the option to use their PSC if they wished, as proof of identity and/or age, in transactions with nonspecified bodies.

  • 10. What is the “Single Customer View”?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Single Customer View (SCV) is a read only, periodically updated, consolidated view of Public Service Identity (PSI) data only. Essentially, it is a mechanism used to enable sharing of the PSI dataset with specified bodies. The Single Customer View is held electronically on secure systems owned by the State in a secure Government Data Centre on the private Government Network in Ireland.

  • 11. What data does An Post read off the PSC when it processes a social welfare payment?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    An Post, operating as an agent for the Department of Employment Affairs and Social Protection, is the only organisation that reads the Magnetic stripe for the purposes of accessing the PPS Number. The PPS number is used by the Post Office to make welfare payments to customers in post offices.

  • 12. What government entities and bodies can read a) the chip and/or b) the magnetic stripe on the card (PSC)?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    What data does An Post read off the PSC when it processes a social welfare payment?

     

    All specified bodies may, in law, read the contact chip and magnetic stripe on the PSC.

    However, the contact chip on the Public Services Card and a card reader communicate with each other by cryptographic means. Only card readers specifically programmed to accept the Public Services Card contact chip can do this. To date, no specified body has implemented that technology.

    The Free Travel version of the Public Services Card also contains a contactless chip. This contactless chip allows the Free Travel variant of the Public Services Card to be used across the National Transport Authority’s Integrated Ticketing System commonly known as LEAP. The application is designed to only interact with a ticketing system reader deployed by the National Transport Authority. No personal information on a customer is made available to any transport operator either inside or outside of the jurisdiction when the Public Services Card is used to interact with the ticketing system. Neither does the contactless chip interact with the contact chip.

    An Post, operating as an agent for the Department of Employment Affairs and Social Protection, is the only organisation that reads the Magnetic stripe for the purposes of accessing the PPS Number. The PPS number is used by the Post Office to make welfare payments to customers in post offices.

  • 13. Is it intended to move to SAFE3 level authentication?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    SAFE 2 registration is provided for in legislation. The Department of Employment Affairs and Social Protection has no plans to increase its identity verification requirements to SAFE Level 3. Any such increase would have to be provided for in legislation that would have to be debated in, and passed by, the Oireachtas.

  • 14. Why do I need a PSC for MyGovID if my physical card is not read as part of the process of registration?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    To use a verified MyGovID account a person’s identity must first be verified to the SAFE 2 standard. This is because MyGovID transfers elements of the person’s PSI to the Specified Body being accessed for the purposes of completing a transaction online. In addition, in the course of using MyGovID to access a public service, the customer may be permitted to view and change personal data held by that public body for the purposes of that transaction and their public function. Therefore, in order to protect a person’s personal details and transactions with public bodies in the online environment, it isn’t sufficient to simply provide a PPS Number and assert SAFE 2 compliance.

    As part of the application of the SAFE 2 standard in the online environment, we seek to ensure that a person’s MyGovID account is not used by another person. We do this by employing two-factor authentication each time the person uses the account. This means that, in addition to requesting a username and password (things you know), we send a one-time verification code to your verified mobile phone (something you have) which you must also provide when logging in.

    It isn’t necessary to get a MyGovID account when you verify your identity to the SAFE 2 standard (although we would strongly encourage it). It is possible to set up your account later and by remote means – in other words you don’t have to come back to a SAFE registration centre. For the same reasons as above we have to be sure that we link the account to the proper SAFE 2 verified PSI dataset. Accordingly we will check a number of things with you – some of the details of your PSC may be included in that check. Full details on MyGovID are available on the dedicated website www.mygovid.ie.

  • 15. Do I have to complete the SAFE process?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Yes, all recipients of welfare services and payments in Ireland have or will be asked to complete the SAFE registration process (some exceptions may be made for example in respect of people with profound disabilities). Failure to complete a SAFE registration process when requested can result in refusal of a new welfare claim or withdrawal of an existing payment or benefit.

  • 16. How long is the Public Services Card Valid for?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Each card has a validity period of up to 7 years. Validity can be dependent on the circumstances of the individual e.g. in circumstances where a free-travel entitlement is time-bound. A new card will issue provided one is required by the individual. PSC holders will be written to three months in advance of their card expiring advising them to renew their PSC. You do not have to go through the SAFE process again to renew your card but a new photograph is required. See also How frequently will an individual be required to update their data for SAFE? eg. photograph?

  • 17. Why isn’t a passport or driving licence sufficient to establish identity for the Department of Employment Affairs and Social Protection?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Taken individually, neither a passport, nor a driver’s license is enough to validate an identity to SAFE Level 2 because they were not issued following a SAFE 2 identity verification process. However, in combination, and with the other data and processes detailed above, passports and driving licences that do not meet the SAFE 2 standard can be used in the methods to verify an identity to SAFE Level 2.

  • 18. Is SAFE registration mandatory for all residents in Ireland?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    It is not mandatory for all people resident in Ireland to be SAFE 2 registered.

    However it is necessary, and has always been necessary, that people using high value public services are required to provide some proof of identity. Now, in order to ensure services are provided to the right person and to support efficient service delivery a growing number of public service providers are requiring that proof of identity is underpinned by the SAFE 2 identity verification standard.

  • 19. Why are public service providers requiring me to supply the PSC to authenticate my identity?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Why are my other forms of identity such as my Passport or driving licence no longer an acceptable form of ID?

    Until recent times, many public services were provided to people who had their identity verified only to the SAFE Level 1 standard. For example, “identity documents” such as Passports and Driver Licences were issued following SAFE Level 1 equivalent registration processes.

    Since the introduction of SAFE Level 2 registration in 2011, more services are now moving to identity verification at this level to ensure a substantial level of assurance of identity. While it is a matter for each public service provider to determine the appropriate level of identity verification required for each of its services, it is Government policy that SAFE 2 registration is required for access to all services that require substantial proof of a person’s identity.

    SAFE Level 2 identity verification benefits the public and public service providers by –

    • simplifying the identity registration process and reducing the need for people to register separately with multiple service providers;
    • reducing the need for service providers to duplicate costly and time consuming identity registration processes;
    • reducing the number of people fraudulently claiming to be someone else as it provides the most robust identity proofing process to protect personal data used in the public service; and
    • facilitating the secure provision of high-value and personalised public services online through the MyGovID platform underpinned by SAFE 2 identity verification.
  • 20. What are the services that will require an individual to have SAFE registered and the timelines by which SAFE 2 registration will be required?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    SAFE 2 identity verification is currently required for –

    • Access to Social Welfare Services (including Child Benefit and Treatment
      Benefits)
    • First time adult passport applicants in the state
    • Replacement of lost, stolen or damaged passports issued prior to January 2005, where the person is resident in the State
    • Citizenship applications
    • Driver Theory Test Applicants
    • Access to high value or personal online public services, e.g. Social Protection’s MyWelfare and Revenue’s MyAccount services via MyGovID, the identity authentication mechanism for accessing public services online.

    The Department of Public Expenditure and Reform recently published the eGovernment Strategy 2017 – 2020 which lists a number of public services for which SAFE 2 registration will be required. These are set out in the table below with relevant timelines. Others are likely to be listed in the future. The transition plans, including communications, will be developed by the Departments/agencies concerned working with the Office of the Government Chief Information Officer (OGCIO) in the Department of Public Expenditure and Reform.

     

    Department Office Service Note Date
    Dept. Education and Skills School Transport Appeal Submission of a school transport appeal will require submitter to be SAFE 2 registered; Online submission of appeal will be available via MyGovID Sep- 17
    Dept. Employment Affairs & Social Protection Treatment Benefit Eligibility checking for treatment benefits (dental/optical/aural) available via MyWelfare using MyGovID Nov-17
    Road Safety Authority Drivers
    Licence
    Application
    Driver licence applications will require applicants to be SAFE 2 registered; Online renewal of drivers licences to be introduced and use MyGovID Mar-18
    Student Universal Support
    Ireland (SUSI)
    Student Grant
    Application
    MyGovID will be used as the authentication mechanism to provide access to the student grant scheme for the 2018/19 academic year; Applicants will have to be SAFE 2 registered in order to make an application Apr-18
    Dept. Education and Skills School Grant Appeal Submission of a school grant appeal will require submitter to be SAFE 2 registered; Online submission of appeal will be possible via MyGovID Sep-18
    Health Service Executive Online
    Health
    Portal
    MyGovID will be used as the authentication mechanism to provide access to a new online Health portal being launch in 2018 – this portal is to provide access to a growing number of health related services online. Sep-18
    Dept. Agriculture, Food
    and the Marine
    Agfood.ie Support for individual access to the Agfood.ie set of services via MyGovID Sep-18
    Dept. Justice and Equality;
    Dept. Employment Affairs & Social Protection
    Proof of Age Introduce the optional use of the PSC as an Age Card for use as a Proof of Age service Q3-18
    Dept. Foreign Affairs and Trade Passport
    Application
    All adult passport applications, new and renewals, for residents in Ireland will require applicants to be SAFE 2 registered; Online renewal of adult passports will use MyGovID Q4-18
  • 21. What is the Public Service Identity Set?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The public service identity (PSI) set used to verify a person’s identity comprises each person’s –

    • PPS Number
    • Surname
    • Forename
    • Date of birth
    • Place of birth
    • Sex
    • All former surnames (if any)
    • All former surnames (if any) of his or her mother
    • Address
    • Nationality
    • Photographic image
    • Signature
    • Date of Death, where relevant
    • Certificate of Death, where relevant
    • Any other information as may be required for authentication purposes that is uniquely linked to or is capable of identifying that person
    • Any other information that may be prescribed which, in the opinion of the Minister, is relevant to and necessary for the allocation of a Personal Public Service Number

    The PSI dataset is defined in Section 262 (1) of the Social Welfare Consolidation Act 2005 (as amended) and the individual data items are set out at Section 262 (3) of that Act.

    During a SAFE registration, some security questions are also asked and the answers to these are recorded – these are required as subsequent security checks when a person contacts the Department about their PSI data or their PSC.

    People are asked to answer only 2 of the following 10 security questions and leave the remainder blank.

    People are reminded that these questions may be used to assist in confirming a person’s identity when they contact the Department about their SAFE registration or their PSC so it is important that they can easily remember the responses they provided.

    Questions to choose from –

    1. What was your childhood nickname?
    2. What was the make of your first car?
    3. What was the surname of your best childhood friend?
    4. What is your maternal grandmother’s birth surname?
    5. Where was your first holiday?
    6. What is the middle name of your oldest child?
    7. What primary school did you attend?
    8. What is your oldest child’s birth month (e.g. January)?
    9. What was the location of your first employment?
    10. What is your favourite sport?
  • 22. What are the advantages of SAFE Registration?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    SAFE Level 2 (SAFE 2) registration, used by the Department of Employment Affairs and Social Protection, allows a person to verify their identity once not just for access to services provided by the Department but also for an increasing number of public services provided by other State agencies – for example the Passport Office. As more public service providers move to using SAFE 2, people who are already registered to SAFE 2 will not need to repeatedly register their identity information when accessing public services.

    In addition once a person is registered to SAFE 2 they can be issued with a Public Services Card (PSC). This card is an easy to use means of verifying identity when collecting welfare payments and using services funded by the Department of Employment Affairs and Social Protection such as the free travel scheme. The PSC replaces other identity and entitlement tokens including the Social Welfare Services Card, the ‘pensions book’, and the paper free travel pass with one convenient identity card.

    SAFE 2 registration also protects the public interest by helping to minimise identity fraud and detect fraudulent claims in our welfare system.

  • 23. Are spouses and family members linked on the SAFE register, and if so, for what purpose may they be identified?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The PSI dataset does not contain relationship information and hence no relationship information is linked within the PSI dataset nor can it be shared with specified bodies for the purpose of identity verification.

  • 24. Is the Government seeking to create a complete “population register” through requiring SAFE registration? If so, why?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Government is not seeking to create a complete population register through requiring SAFE registration.

    Rather, SAFE Level 2 registration allows a person to verify their identity once for public service purposes to a substantial level of assurance. Consequently, it eliminates the need for a person to repeatedly register their identity information when accessing public services. It makes it more difficult for someone else to claim to be a person and so helps to eliminate “identity theft” and fraudulent access to those public services and/or to someone else’s data. Accordingly, verifying identity to a substantial level of assurance ultimately reduces the administrative burden both on public service providers and on individuals accessing their services. It also facilitates those providers in making their services, particularly those of a high-value or personal nature, available through online channels (which would not be possible otherwise).

  • 25. Is it sufficient for an individual to supply their PPS Number to a body once they are SAFE registered and not produce their PSC, particularly if that body is not physically reading the chip or magnetic stripe on the card?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Once a person completes a SAFE 2 registration they can be issued with a Public Services Card (PSC) as a physical token that proves they have had their identity verified to the SAFE 2 standard (simply quoting a PPS Number does not prove a person’s identity nor does it prove that their identity has been verified to the SAFE 2 standard).

    It is a matter for each specified body to determine, subject to obtaining permission from the Department of Employment Affairs and Social Protection, if it wishes to access the PSI data stored on the PSC. However in most cases examination of the photographic image on the PSC and comparison of signature can validate that the card belongs to the holder.

    The presentation of the card also enables the service provider to rely on the data held in the Single Customer View and compare that data with data presented at the point of transaction by the customer.

  • 26. Does the Public Services Card store biometrics?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    No. While the card does store a person’s photograph it does not store the biometric or arithmetic template of that photograph. Nor is the biometric or arithmetic template of the photo stored in the PSI dataset or shared with other public bodies.

  • 27. What departments, agencies and offices feed data into the Single Customer View?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The single customer view combines PSI data held by the following contributors –

    • Department of Employment Affairs and Social Protection;
    • Department of Agriculture, Food and the Marine;
    • Department of Tourism, Transport and Sport;
    • Revenue Commissioners;
    • Health Service Executive (Primary Care Reimbursement Service); and
    • General Register’s Office (Death Registrations). The PSI data displayed will be that obtained by each contributor during their most recent transaction with the customer. This allows all specified bodies the opportunity to check the currency of their PSI data and a means of keeping it up to date.

    The PSI data displayed will be that obtained by each contributor during their most recent transaction with the customer. This allows all specified bodies the opportunity to check the currency of their PSI data and a means of keeping it up to date.

  • 28. Lost or damaged Public Services Cards
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    If your Public Services Card is lost, stolen or damaged, you should immediately contact the Public Services Card Helpdesk at 1890 837000.

  • 1. If the Passport office currently requires a photocopy of the PSC for the purposes of passport processing, how is this utilising the security features the card was designed with?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    What does the Passport Office do with the photocopy?

    How does it assist the Passport office in authenticating identity?

     

    The Passport Service currently requires a photocopy of the PSC for first time adult applicants and those replacing lost, stolen or damaged passports that were issued prior to 2005. A photocopy of the PSC is currently required as evidence that the applicant is SAFE 2 registered, but the Passport Service does not require nor does it utilise the security features of the card itself.

    The photocopy of the PSC enables the Passport Service to authenticate an applicant’s identity by verifying their details against the Single Customer View (SCV). The photocopy of the card is scanned onto the Passport Service system. The photocopy is then securely stored before being shredded in line with the Passport Service’s data retention policy. This is an interim process which the Passport Service will streamline over the next two years through its Passport Reform Programme. The new Passport Application process will enable passport applicants to access its services online and verify their identity using the MyGovID solution – thereby removing the need for applicants to submit a photocopy of their PSC.

  • 2. How is the data technically and organisationally secured by the controller?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Can I be confident that my personal identity/registration data is secure on this State register?

     

    The Department of Employment Affairs and Social Protection is committed to ensuring that data relating to customers is securely held and used only for relevant business purposes. The Department’s commitment to safeguarding data is reflected in its use of advanced data processing and storage technology hosted in secure datacentres and is reinforced by a range of legislative and administrative provisions that are designed to protect the rights and interests of our customers.

    These provisions include the Official Secrets Act 1963, the Data Protection Acts 1988 and 2003, the Social Welfare Consolidation Act 2005 and the Civil Service Code of Standards and Behaviour. They impose obligations in relation to the confidentiality of official data and the protection of records against unauthorised access, unnecessary use, alteration, destruction or disclosure.
    For these reasons –

    • the PSI data set is stored and maintained in the Department’s own secure datacentres using best-in-class data security systems;
    • the Single Customer View database is stored in a secure government data centre. Access to the data is tightly controlled and restricted to specified bodies on the private Government Network. All data access is logged and regularly audited;
    • access to the dataset is restricted to those members of staff who have a business need to reference the data;
    • all members of staff are reminded regularly through various awareness, education and training initiatives of data protection law and the primacy of client confidentiality, the obligations they have to maintain both, and the potential penalties that are applicable in respect of any breach;
    • all members of staff must, on an annual basis, sign undertakings that they have read, and will act in accordance with, data protection policies and guidelines;
    • staff that fail to comply with these guidelines are subject to disciplinary action (up to and including dismissal). In addition they may be subject to potential legal action including possible claim for compensation for distress/damage caused to the customer;
    • all accesses to the data are logged and are subject to independent audit;
    • Twenty eight security audits have been undertaken within the last five years (2012 – 2017), twenty two of these are completed, and six are in progress. Three Penetration tests, two Privacy Impact Assessments, and a Risk Assessment of the Information Systems environment were also carried out during this timeframe;
    • a dedicated Business Information Security Unit (BISU) is responsible for overseeing information security and data protection awareness and compliance across the Department,
      • BISU develops, reviews and communicates policies, guidelines and procedures covering the use of data to help effectively implement data protection legislation and information security best practice,
      • It supports business areas by providing advice on data protection and information security matters relevant to their work,
      • it works closely with our Information Technology staff on technical security matters, and
      • it provides a liaison function with the Office of the Data Protection Commissioner on data protection matters and policies.
  • 3. How is the data shared?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    There are numerous means by which PSI data can be shared with specified bodies which include secure file transfers and application programming interfaces between systems, access to the contact chip on the PSC (see the responses to What PSI data is either stored on the card or appears on the front of the card? and What government entities and bodies can read a) the chip and/or b) the magnetic stripe on the card (PSC)?), access to the Single Customer View (see responses to the following question Q1, Q2, Q3, Q4, Q5, Q6, Q7), and use of the MyGovID online identity verification solution (see responses to What is MyGovID and am I legally required to have a MyGovID account? and Why do I need a PSC for MyGovID if my physical card is not read as part of the process of registration?).

  • 4. What company produces these cards and what safeguards are in place to safeguard the use of data by this company?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    For how long is the contract to be in place between the controller and the provider?

     

    The PSC is produced in Ireland by an Irish-registered company called Biometric Card Services (BCS) under contract to the Department. The current contract is due to expire at the end of 2017. That contract includes a number of conditions designed to safeguard the data. For example it is a condition of contract that all data and related services provision and operation be provided on-site in Ireland and subject to the terms of the Data Protection Acts and the jurisdiction of the Irish courts. All data to be personalised onto PSCs (i.e., transferred onto cards) is provided by the Department of Employment Affairs and Social Protection to BCS over the private Government Network. Before any data is transferred, the Department and BCS systems mutually authenticate each other. The data is encrypted so that no third party can access the data, and electronically signed so that BCS can be certain that the data originates from the Department and has not been modified en route. All of these processes are implemented using strong cryptography according to international and industry standards. Once PSCs are personalised the data used to so personalise them is not retained by BCS but is destroyed as an automatic part of the personalisation process in accordance with advice provided by the Office of the Data Protection Commissioner. In addition the systems used in the card production have been subjected to audit by external experts.

  • 5. What is the “Single Customer View”?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Single Customer View (SCV) is a read only, periodically updated, consolidated view of Public Service Identity (PSI) data only. Essentially, it is a mechanism used to enable sharing of the PSI dataset with specified bodies. The Single Customer View is held electronically on secure systems owned by the State in a secure Government Data Centre on the private Government Network in Ireland.

  • 6. What data does An Post read off the PSC when it processes a social welfare payment?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    An Post, operating as an agent for the Department of Employment Affairs and Social Protection, is the only organisation that reads the Magnetic stripe for the purposes of accessing the PPS Number. The PPS number is used by the Post Office to make welfare payments to customers in post offices.

  • 7. What government entities and bodies can read a) the chip and/or b) the magnetic stripe on the card (PSC)?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    What data does An Post read off the PSC when it processes a social welfare payment?

     

    All specified bodies may, in law, read the contact chip and magnetic stripe on the PSC.

    However, the contact chip on the Public Services Card and a card reader communicate with each other by cryptographic means. Only card readers specifically programmed to accept the Public Services Card contact chip can do this. To date, no specified body has implemented that technology.

    The Free Travel version of the Public Services Card also contains a contactless chip. This contactless chip allows the Free Travel variant of the Public Services Card to be used across the National Transport Authority’s Integrated Ticketing System commonly known as LEAP. The application is designed to only interact with a ticketing system reader deployed by the National Transport Authority. No personal information on a customer is made available to any transport operator either inside or outside of the jurisdiction when the Public Services Card is used to interact with the ticketing system. Neither does the contactless chip interact with the contact chip.

    An Post, operating as an agent for the Department of Employment Affairs and Social Protection, is the only organisation that reads the Magnetic stripe for the purposes of accessing the PPS Number. The PPS number is used by the Post Office to make welfare payments to customers in post offices.

  • 8. When SAFE registration data is collected from individuals through government bodies, is that registration data kept on one centralised State register?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Department of Employment Affairs and Social Protection is the sole body in the State currently undertaking SAFE 2 registrations. During a SAFE 2 registration, those elements of the Public Service Identity dataset (see response to What is the Public Service Identity Set?) that are already held for that person are verified and updated as necessary, and missing elements are collected and verified. In that way, the Department holds a complete Public Service Identity dataset for each person that it has verified to SAFE 2 standard.

    As provided for in the Social Welfare Consolidation Act 2005 (as amended) any PSI data collected by another identified public service provider (being a ‘Specified Body’) can also be used, for the purpose of maintaining a person’s public service identity, i.e., their PSI dataset. For the purpose of enabling shared use of the PSI data elements with Specified Bodies the Department of Public Expenditure and Reform operates a facility known as the Single Customer View. This enables each Specified Body, in accordance with permissions granted by the Department of Employment Affairs and Social Protection, to access and use the PSI dataset. This in turn facilitates the re-use of the PSI dataset and the avoidance of customers having to resubmit the same identity information on multiple occasions.

    The Department of Employment Affairs and Social Protection is the data controller for the Single Customer View. Access to and use of data held in the Single Customer View database by other specified bodies is managed and controlled by the Department in accordance with the arrangements described at What governance arrangements are in place for the Single Customer View?.

  • 9. What protection mechanisms are built into the Public Service Card itself?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Public Services Card itself has multiple protection mechanisms, all of the highest current international standards, to prevent and detect tampering with the physical card and its contents. As well as some hidden security features, there are visual measures such as the overall graphical design, branding, microprinting, the use of optical variable ink and a kinegram. In addition, a PSC and a card reader communicate with each other by cryptographic means. Only card readers specifically programmed to accept PSCs can undertake this functionality.

  • 10. Why do I need a PSC for MyGovID if my physical card is not read as part of the process of registration?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    To use a verified MyGovID account a person’s identity must first be verified to the SAFE 2 standard. This is because MyGovID transfers elements of the person’s PSI to the Specified Body being accessed for the purposes of completing a transaction online. In addition, in the course of using MyGovID to access a public service, the customer may be permitted to view and change personal data held by that public body for the purposes of that transaction and their public function. Therefore, in order to protect a person’s personal details and transactions with public bodies in the online environment, it isn’t sufficient to simply provide a PPS Number and assert SAFE 2 compliance.

    As part of the application of the SAFE 2 standard in the online environment, we seek to ensure that a person’s MyGovID account is not used by another person. We do this by employing two-factor authentication each time the person uses the account. This means that, in addition to requesting a username and password (things you know), we send a one-time verification code to your verified mobile phone (something you have) which you must also provide when logging in.

    It isn’t necessary to get a MyGovID account when you verify your identity to the SAFE 2 standard (although we would strongly encourage it). It is possible to set up your account later and by remote means – in other words you don’t have to come back to a SAFE registration centre. For the same reasons as above we have to be sure that we link the account to the proper SAFE 2 verified PSI dataset. Accordingly we will check a number of things with you – some of the details of your PSC may be included in that check. Full details on MyGovID are available on the dedicated website www.mygovid.ie.

  • 11. Why isn’t a passport or driving licence sufficient to establish identity for the Department of Employment Affairs and Social Protection?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Taken individually, neither a passport, nor a driver’s license is enough to validate an identity to SAFE Level 2 because they were not issued following a SAFE 2 identity verification process. However, in combination, and with the other data and processes detailed above, passports and driving licences that do not meet the SAFE 2 standard can be used in the methods to verify an identity to SAFE Level 2.

  • 12. Why are public service providers requiring me to supply the PSC to authenticate my identity?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Why are my other forms of identity such as my Passport or driving licence no longer an acceptable form of ID?

    Until recent times, many public services were provided to people who had their identity verified only to the SAFE Level 1 standard. For example, “identity documents” such as Passports and Driver Licences were issued following SAFE Level 1 equivalent registration processes.

    Since the introduction of SAFE Level 2 registration in 2011, more services are now moving to identity verification at this level to ensure a substantial level of assurance of identity. While it is a matter for each public service provider to determine the appropriate level of identity verification required for each of its services, it is Government policy that SAFE 2 registration is required for access to all services that require substantial proof of a person’s identity.

    SAFE Level 2 identity verification benefits the public and public service providers by –

    • simplifying the identity registration process and reducing the need for people to register separately with multiple service providers;
    • reducing the need for service providers to duplicate costly and time consuming identity registration processes;
    • reducing the number of people fraudulently claiming to be someone else as it provides the most robust identity proofing process to protect personal data used in the public service; and
    • facilitating the secure provision of high-value and personalised public services online through the MyGovID platform underpinned by SAFE 2 identity verification.
  • 13. What is the Public Service Identity Set?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The public service identity (PSI) set used to verify a person’s identity comprises each person’s –

    • PPS Number
    • Surname
    • Forename
    • Date of birth
    • Place of birth
    • Sex
    • All former surnames (if any)
    • All former surnames (if any) of his or her mother
    • Address
    • Nationality
    • Photographic image
    • Signature
    • Date of Death, where relevant
    • Certificate of Death, where relevant
    • Any other information as may be required for authentication purposes that is uniquely linked to or is capable of identifying that person
    • Any other information that may be prescribed which, in the opinion of the Minister, is relevant to and necessary for the allocation of a Personal Public Service Number

    The PSI dataset is defined in Section 262 (1) of the Social Welfare Consolidation Act 2005 (as amended) and the individual data items are set out at Section 262 (3) of that Act.

    During a SAFE registration, some security questions are also asked and the answers to these are recorded – these are required as subsequent security checks when a person contacts the Department about their PSI data or their PSC.

    People are asked to answer only 2 of the following 10 security questions and leave the remainder blank.

    People are reminded that these questions may be used to assist in confirming a person’s identity when they contact the Department about their SAFE registration or their PSC so it is important that they can easily remember the responses they provided.

    Questions to choose from –

    1. What was your childhood nickname?
    2. What was the make of your first car?
    3. What was the surname of your best childhood friend?
    4. What is your maternal grandmother’s birth surname?
    5. Where was your first holiday?
    6. What is the middle name of your oldest child?
    7. What primary school did you attend?
    8. What is your oldest child’s birth month (e.g. January)?
    9. What was the location of your first employment?
    10. What is your favourite sport?
  • 14. Who are the bodies with whom the Department shares PSI data?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The full list of specified bodies that may use PSI data under Sections 260-265 of the Social Welfare Consolidation Act 2005 (as amended) is contained in Schedule 5 of the Social Welfare Consolidation Act and is included in the list of  Scheduled Bodies. Separately, those bodies that actually received Public Service Identity data in 2016 that was collected by the Department of Employment Affairs and Social Protection along with the relevant legislative basis under which they could access and use this data are listed here. Use of PSI data for specific purposes is also provided for in other legislation and these instances are outlined in this link.

  • 15. What governance mechanisms have been put in place to oversee and underpin the sharing of PSI data?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Will these arrangements be made public?

    The governance of the shared use of PSI data is set out in, and underpinned by, the Social Welfare Consolidation Act, 2005 (as amended). Section 262 of the Act sets out how the sharing and use of the PSI data is restricted to public service bodies specified in law or their agents (i.e., organisations working on their behalf or performing one of their public functions under contract). Designation as a specified body requires primary legislation and as such can only be done by an Act of the Oireachtas.

    The primary legislative basis for the sharing of PSI data is set out in Sections 262 (5) and 262 (6) of the Social Welfare Consolidation Act. Section 262 (5) provides that where a specified body collects any element of PSI data from a person in the course of a providing a service or undertaking a transaction, that information shall also be collected for the purpose of maintaining the person’s public service identity. This means that the dataset can be kept up to date by using data from the person’s most recent interaction with a specified body.

    Specific provision for other specified bodies using the PSI data collected by the Department is made in section 262 (6) which provides that “where a specified body has a transaction with a person, the Minister may share the person’s public service identity with the specified body to the extent necessary in respect of that transaction for authentication by the specified body of the person’s public service identity” and “a specified body may use a person’s public service identity in performing its public functions insofar as those functions relate to the person concerned.”

    Such specified bodies are in all cases required to process and store data in accordance with the Data Protection Acts.

  • 16. Are spouses and family members linked on the SAFE register, and if so, for what purpose may they be identified?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The PSI dataset does not contain relationship information and hence no relationship information is linked within the PSI dataset nor can it be shared with specified bodies for the purpose of identity verification.

  • 17. Is the Government seeking to create a complete “population register” through requiring SAFE registration? If so, why?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Government is not seeking to create a complete population register through requiring SAFE registration.

    Rather, SAFE Level 2 registration allows a person to verify their identity once for public service purposes to a substantial level of assurance. Consequently, it eliminates the need for a person to repeatedly register their identity information when accessing public services. It makes it more difficult for someone else to claim to be a person and so helps to eliminate “identity theft” and fraudulent access to those public services and/or to someone else’s data. Accordingly, verifying identity to a substantial level of assurance ultimately reduces the administrative burden both on public service providers and on individuals accessing their services. It also facilitates those providers in making their services, particularly those of a high-value or personal nature, available through online channels (which would not be possible otherwise).

  • 18. Is it sufficient for an individual to supply their PPS Number to a body once they are SAFE registered and not produce their PSC, particularly if that body is not physically reading the chip or magnetic stripe on the card?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Once a person completes a SAFE 2 registration they can be issued with a Public Services Card (PSC) as a physical token that proves they have had their identity verified to the SAFE 2 standard (simply quoting a PPS Number does not prove a person’s identity nor does it prove that their identity has been verified to the SAFE 2 standard).

    It is a matter for each specified body to determine, subject to obtaining permission from the Department of Employment Affairs and Social Protection, if it wishes to access the PSI data stored on the PSC. However in most cases examination of the photographic image on the PSC and comparison of signature can validate that the card belongs to the holder.

    The presentation of the card also enables the service provider to rely on the data held in the Single Customer View and compare that data with data presented at the point of transaction by the customer.

  • 19. What PSI data is either stored on the card or appears on the front of the card?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The data that may be displayed on the PSC and electronically stored is set out at Sections 263 (1A) and Section 263 (1B) respectively of the Social Welfare Consolidation Act. The following sets out where each data item appears or is stored on the PSC –

    • the name of the person:
      • Face of PSC and Chip
    • the personal public service number (PPSN) of that person:
      • Rear of PSC, Chip, and Magnetic stripe
    • a photograph of that person:
      • Face of PSC and Chip
    • the signature of the person:
      • Face of PSC and Chip
    • the issue number of the public services card:
      • Rear of the PSC and Chip
    • the expiry date of the PSC:
      • Face of PSC and Chip
    • the date of birth of that person:
      • Chip and Magnetic stripe
    • the place of birth of that person:
      • Chip
    • the sex of that person:
      • Chip and Magnetic stripe
    • the nationality of that person:
      • Chip
    • all former surnames (if any) of that person:
      • Chip
    • all former surnames (if any) of the mother of that person:
      • Chip
  • 20. Does the Public Services Card store biometrics?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    No. While the card does store a person’s photograph it does not store the biometric or arithmetic template of that photograph. Nor is the biometric or arithmetic template of the photo stored in the PSI dataset or shared with other public bodies.

  • 21. Where is the biometric or arithmetic template of the photograph stored and who has access to it?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Department of Employment Affairs and Social Protection uses facial image matching software to strengthen the SAFE registration process by detecting and deterring duplicate SAFE registration attempts. The normal digital photograph (in JPEG format) captured during the SAFE registration process is input into and stored in this facial image matching software. It is then modelled and searched against the Department’s photo database to ensure that the person in the photograph has not already been registered using a different Personal Public Service Number or a different identity dataset. The software compares photographs by converting the image into an arithmetic template based on the individual’s facial characteristics, e.g., distance between their eyes, height of cheekbones etc., and checking it against the other image templates already held in that software’s database from other SAFE registrations. A similar approach is taken by the Passport Office in its systems when processing passport applications/renewals. Up to the end of September 2017 the Department had detected some 165 cases of suspected identity fraud as a result of this matching process.

    It is important to note that the arithmetic models behind the photographs do not get stored on the PSC or in the Public Service Identity dataset. Consequently, this data is not shared with any other public body. They are only stored in the facial image matching software’s database held in the Department’s own secure datacentres.

    It is also important to note that the Department does not ask for or collect other biometric data from our customers (e.g., fingerprints, retinal scans, etc.) nor does it use advanced facial mapping cameras when taking the photo as part of the SAFE registration process.

  • 22. What departments, agencies and offices feed data into the Single Customer View?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The single customer view combines PSI data held by the following contributors –

    • Department of Employment Affairs and Social Protection;
    • Department of Agriculture, Food and the Marine;
    • Department of Tourism, Transport and Sport;
    • Revenue Commissioners;
    • Health Service Executive (Primary Care Reimbursement Service); and
    • General Register’s Office (Death Registrations). The PSI data displayed will be that obtained by each contributor during their most recent transaction with the customer. This allows all specified bodies the opportunity to check the currency of their PSI data and a means of keeping it up to date.

    The PSI data displayed will be that obtained by each contributor during their most recent transaction with the customer. This allows all specified bodies the opportunity to check the currency of their PSI data and a means of keeping it up to date.

  • 23. What third parties have access to the data in the Single Customer View (SCV)?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    No ‘third parties’ have access to the Single Customer View. All Specified Bodies are legally entitled to access the Single Customer View.

    To date, the following Specified Bodies have been granted access to various services (see What government entities and bodies can read a) the chip and/or b) the magnetic stripe on the card (PSC)? for an explanation of these) on the Single Customer View as follows –

    • Department of Employment Affairs and Social Protection (PSI look-up and Control application)
    • Passport office (Department of Foreign Affairs and Trade) (PSI look-up)
    • Residential Tenancy Board (Control application)
    • Department of Justice (section that processes Naturalisation certificates) (PSI look-up)
    • Irish Prisons Service (PSI look-up)
    • Road Safety Authority (PSI look-up and PSI Reporting)
    • Revenue Commissioners (PSI Reporting)
    • Department of Education (PSI Reporting)
    • Pobal (PSI Reporting)
    • NTMA (PSI Reporting)
  • 24. Who is the State data controller of the “Single Customer View”?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Single Customer View is maintained in the Department of Public Expenditure and Reform on behalf of the Department of Employment Affairs and Social Protection. The Secretary General of the Department of Employment Affairs and Social Protection is the Data Controller.

  • 25. What governance arrangements are in place for the Single Customer View?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    What safeguards are in place for the single customer view?

    For example, how do you ensure that entities providing information to the single customer view do not provide more information that is required under law. What mechanisms ensure that State entities do not have access to irrelevant or excessive personal data?

     

    The Single Customer View system supports four data services that can be accessed by Specified Bodies, viz.

    1. PPSN Checker which allows a specified body to validate a PPSN, Name, Address and Date of Birth in real-time – it simply confirms if the data input is valid or not;
    2. PSI Lookup which allows a specified body to lookup the PSI data for an individual based on PPS Number;
    3. PSI Reporting which facilitates specified bodies in comparing their PSI data with that held on the system to assist them with their overall PSI data quality; and
    4. Control which facilitates specified bodies to view and search all of the PSI information in the Single Customer View for control and/or fraud detection purposes.

    All specified bodies can access the PPSN checker (Item 1).

    However, the Department of Employment Affairs and Social Protection must formally approve access to the other three services. That approval is conditional on a business need being established and on the agreement to and implementation of rigorous data security and protection (both technical and business) protocols and standards. This includes the nomination of a Compliance Officer in the specified body who liaises with the Client Identity Services Division of the Department of Employment Affairs and Social Protection with respect to each element of the agreement. That Compliance Officer is responsible for managing the agreement, for nominating specific officers to access specific services on the Single Customer View, and for ensuring that each such officer signs an Officer User Agreement (this agreement sets out the officer’s responsibilities under Social Welfare legislation in relation to the use of the PPS number/Public Service Identity Data, and the Data Protection Acts 1988 and 2003).

    All accesses to the Single Customer View application are logged. Information is logged about what information was accessed, by whom, and when. The Office of the Government Chief Information Officer in the Department of Public Expenditure and Reform, the Client Identity Services Division of the Department of Employment Affairs and Social Protection and the user organisations management hierarchy can access all relevant access history on the Single Customer View.

  • 26. Lost or damaged Public Services Cards
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    If your Public Services Card is lost, stolen or damaged, you should immediately contact the Public Services Card Helpdesk at 1890 837000.

  • 1. How do people register to SAFE 2 standard?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Department operates a number of methods to SAFE 2 register a person. The usual method involves a combination of all of the following –

    • a face-to-face meeting at an Intreo centre or a dedicated SAFE registration centre
    • the collection and verification of the basic identity information known as the person’s Public Service Identity (PSI) data set (See Question 18),
    • the examination/validation/verification of at least two documents supporting identity, and
    • photo-matching.

    As part of the verification process the person’s photo is run through software to check against other photos that have already been taken during other SAFE registrations. This is to detect and/or prevent duplicate registrations.

    In some cases, where a customer authenticates their identity in another face-to-face engagement, the Department may collect elements of the PSI data by post and, with the consent of the customer, utilise existing photographs to complete the SAFE 2 process. This eliminates the need to attend at an Intreo centre or a dedicated SAFE Registration centre specifically for the purpose of registering to SAFE 2.

    The Department can also provide a mobile registration service to cater for people who have difficulty attending an Intreo centre or a SAFE registration centre

  • 2. How long does the SAFE registration process take and when will I get my Public Services Card?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The process takes about 15 minutes to complete, once all required documents are presented. Once complete it takes 5-7 working days for your PSC to arrive by post to your address.

  • 3. How frequently will an individual be required to update their data for SAFE? e.g. photograph?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    A person is only required to undertake a SAFE 2 registration process once.

    However the information verified during this process may need to be updated if a person’s circumstances change. Possible changes to PSI data include change of their name (e.g. on marriage), address, nationality (e.g. on naturalisation), sex (e.g. gender re-assignment).

    The Public Services Card that is issued on completion of SAFE registration is valid for up to 7 years. At renewal a new photograph is taken to update the new card
    and the PSI dataset.

    New Public Services Cards may also be required when a person’s status changes, e.g., a person reaching the age of 66 will be automatically issued with a new card with the ‘free travel’ functionality, enabling them to avail of free travel on public transport services.

    Lost cards are replaced using the current elements of the PSI dataset (including photo) and will ordinarily remain valid for the validity period of the original card.

  • 4. How long is the Public Services Card Valid for?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Each card has a validity period of up to 7 years. Validity can be dependent on the circumstances of the individual e.g. in circumstances where a free-travel entitlement is time-bound. A new card will issue provided one is required by the individual. PSC holders will be written to three months in advance of their card expiring advising them to renew their PSC. You do not have to go through the SAFE process again to renew your card but a new photograph is required. See also How frequently will an individual be required to update their data for SAFE? eg. photograph?

  • 5. What do I have to bring to my SAFE registration appointment?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    A. Evidence of identity:

    Irish citizens born in the
    Republic of Ireland
    Current Irish passport or current Irish or UK driving licence or Irish learner driver permit. If you are adopted, please bring your adoption certificate with you. *
    Irish citizens via naturalisation or Foreign Current Irish passport or Certificate of Naturalisation or Foreign Birth Registration certificate and Irish or UK driving
    Birth Registration Licence or Irish learner driver permit. *
    Irish citizens born in Northern Ireland and UK citizens Current passport, or your birth or adoption certificate and current driving licence
    EU citizens (other than Irish and UK) Current passport or national identity card
    Non-EU citizens Current passport or 1951 travel document

    * If you are an Irish or UK citizen and do not have a Passport or Driving licence as identification, you may still be issued with a PSC. When you attend you will have  an in-depth interview and additional information gathered during this interview will be verified in order to confirm your identity.

     

    For Irish citizens born in the Republic of Ireland, birth details can be verified online in most cases with the General Register Office. However, in some cases, it is not possible to locate the birth registration, so the person will need to return with a copy of his/her birth certificate.

    If you wish to get a copy of your Irish birth certificate for SAFE registration purposes, you can get it from the Registrar at a reduced rate when you show your SAFE invitation letter.

    The Department does not have access to the adoption register, so adopted people should bring their adoption certificate with them when attending their appointment.

     

    B. Evidence of address (applies to everyone, whether an Irish, EU or non-EU citizen):

    You need to show evidence of your address. You can use any of the following documents to do this (it must show your name and address):

    • A household utility bill
    • An official letter/document
    • A financial statement
    • Property lease or tenancy agreement
    • Confirmation of address by a third party such as a school principal/ administrator, accommodation/property owner*or manager.

    *If you are staying with friends or relatives an original household bill plus a note from the bill holder confirming your residency at the bill address is acceptable. This note can be written on the bill itself.

     

    C. Additional helpful documents

    If you have any of the items listed below, you should bring them along with you as they may also help to confirm your identity. If you do not have any of these, you should bring other documents or forms of photo ID instead*.

    • Irish Free Travel Pass
    • Medical card issued under the General Medical Service
    • European health insurance card
    • Credit/debit card
    • Student card

    *The following items are not acceptable as proof of identity for the purpose of SAFE registration: Baptismal certificate, work ID card, Garda form ML-10, Garda age card, photocopied certificates or documents and expired documents generally.

    You should also bring your mobile phone with you, if you have one. During the SAFE registration process we can validate your mobile phone number which will make it easier for you to register for a MyGovID verified account. You will need this account if you wish to access public services online. See Question What is MyGovID and am I legally required to have a MyGovID account? for further information.

     

  • 6. Is there a charge for the PSC?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    There is no charge to the individual for the Public Services Card.

  • 7. What processes are in place to SAFE register customers with a disability?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    At present the Departments databases do not include details on the nature and degree of disability, hence the need to write to customers to establish if they have particular requirements to enable them to register for the PSC.

    Where customers are unable to attend in person, other methods for registration are available. A mobile registration facility is available to register customers who face substantial challenges in presenting at a Department location but still want to continue to avail of their free travel entitlement. Group registration at community venues is the preferred mode of utilising these mobile registration facilities but in very exceptional circumstances, single individuals may be registered at their place of residence.

    Where a customer is incapacitated to the extent that they may not be able to understand what is entailed in SAFE registration the Department would reasonably expect that their agent (if an agent is appointed) or carer would assist them in making contact with the Department.

  • 1. Do I have to have a Public Services Card to access a service or be paid a benefit?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Department of Employment Affairs and Social Protection makes it clear to customers in receipt of welfare payments or entitlements that they do need to register to SAFE 2, in accordance with the relevant legislative provisions, to access or to continue to access those payments/entitlements. Once a customer completes the SAFE 2 registration process, they may be issued with a Public Services Card (PSC). The PSC is replacing older documents used to show entitlement to a benefit, including the social welfare services card and the paper travel pass. Accordingly it will in future be necessary to produce a PSC as proof of identity for certain types of transactions, including collecting welfare payments in cash at post offices and availing of free travel on public transport.

  • 2. What is MyGovID and am I legally required to have a MyGovID account?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    A MyGovID account is a secure online account for accessing public services. The process for registering and using a MyGovID account proves in the online environment that the person has had their identity verified to the SAFE 2 standard. By using what is known as two factor authentication linked to the SAFE registration process MyGovID assures the privacy and security of online services. For example, people registered with a MyGovID account can request online access to their PRSI contribution record or can apply online for some welfare services. It is not mandatory for people to use these online services, it is an optional benefit provided to people who are registered to SAFE 2 level. A full description of MyGovID is available on the dedicated website www.mygovid.ie.

    In addition, the MyGovID secure online identity verification system is also essential for Ireland to be aligned with the EU eIDAS regulation, which is a key aspect of the EU’s eGovernment Action Plan and Digital Single Market Strategy. See Why do I need a PSC for MyGovID if my physical card is not read as part of the process of registration? also for more information on MyGovID.

  • 3. Is it intended to increase the scope of the card beyond the Schedule 5 bodies as outlined in the legislation?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    At this time there are no plans to expand the range of specified bodies. Any increase in the number of specified bodies would have to be provided for in legislation and consequently would have to undergo Oireachtas scrutiny prior to enactment.

    One of the provisions set out in Section 5 of the Social Welfare, Pensions, and Civil Registration Bill 2017 would, if enacted, enable customers to volunteer their PSC where they wish to use it as a form of proof of identity and/or age. However, it is important to note that it would remain an offence for a non-specified body or person to request or demand the production of a PSC, or to access data held on the PSC. The proposed legislation would not change the number of specified bodies that can request the PSC. It would simply give individuals the option to use their PSC if they wished, as proof of identity and/or age, in transactions with nonspecified bodies.

  • 4. Do I have to complete the SAFE process?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Yes, all recipients of welfare services and payments in Ireland have or will be asked to complete the SAFE registration process (some exceptions may be made for example in respect of people with profound disabilities). Failure to complete a SAFE registration process when requested can result in refusal of a new welfare claim or withdrawal of an existing payment or benefit.

  • 5. Why are public service providers requiring me to supply the PSC to authenticate my identity?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Why are my other forms of identity such as my Passport or driving licence no longer an acceptable form of ID?

    Until recent times, many public services were provided to people who had their identity verified only to the SAFE Level 1 standard. For example, “identity documents” such as Passports and Driver Licences were issued following SAFE Level 1 equivalent registration processes.

    Since the introduction of SAFE Level 2 registration in 2011, more services are now moving to identity verification at this level to ensure a substantial level of assurance of identity. While it is a matter for each public service provider to determine the appropriate level of identity verification required for each of its services, it is Government policy that SAFE 2 registration is required for access to all services that require substantial proof of a person’s identity.

    SAFE Level 2 identity verification benefits the public and public service providers by –

    • simplifying the identity registration process and reducing the need for people to register separately with multiple service providers;
    • reducing the need for service providers to duplicate costly and time consuming identity registration processes;
    • reducing the number of people fraudulently claiming to be someone else as it provides the most robust identity proofing process to protect personal data used in the public service; and
    • facilitating the secure provision of high-value and personalised public services online through the MyGovID platform underpinned by SAFE 2 identity verification.
  • 6. What are the services that will require an individual to have SAFE registered and the timelines by which SAFE 2 registration will be required?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    SAFE 2 identity verification is currently required for –

    • Access to Social Welfare Services (including Child Benefit and Treatment
      Benefits)
    • First time adult passport applicants in the state
    • Replacement of lost, stolen or damaged passports issued prior to January 2005, where the person is resident in the State
    • Citizenship applications
    • Driver Theory Test Applicants
    • Access to high value or personal online public services, e.g. Social Protection’s MyWelfare and Revenue’s MyAccount services via MyGovID, the identity authentication mechanism for accessing public services online.

    The Department of Public Expenditure and Reform recently published the eGovernment Strategy 2017 – 2020 which lists a number of public services for which SAFE 2 registration will be required. These are set out in the table below with relevant timelines. Others are likely to be listed in the future. The transition plans, including communications, will be developed by the Departments/agencies concerned working with the Office of the Government Chief Information Officer (OGCIO) in the Department of Public Expenditure and Reform.

     

    Department Office Service Note Date
    Dept. Education and Skills School Transport Appeal Submission of a school transport appeal will require submitter to be SAFE 2 registered; Online submission of appeal will be available via MyGovID Sep- 17
    Dept. Employment Affairs & Social Protection Treatment Benefit Eligibility checking for treatment benefits (dental/optical/aural) available via MyWelfare using MyGovID Nov-17
    Road Safety Authority Drivers
    Licence
    Application
    Driver licence applications will require applicants to be SAFE 2 registered; Online renewal of drivers licences to be introduced and use MyGovID Mar-18
    Student Universal Support
    Ireland (SUSI)
    Student Grant
    Application
    MyGovID will be used as the authentication mechanism to provide access to the student grant scheme for the 2018/19 academic year; Applicants will have to be SAFE 2 registered in order to make an application Apr-18
    Dept. Education and Skills School Grant Appeal Submission of a school grant appeal will require submitter to be SAFE 2 registered; Online submission of appeal will be possible via MyGovID Sep-18
    Health Service Executive Online
    Health
    Portal
    MyGovID will be used as the authentication mechanism to provide access to a new online Health portal being launch in 2018 – this portal is to provide access to a growing number of health related services online. Sep-18
    Dept. Agriculture, Food
    and the Marine
    Agfood.ie Support for individual access to the Agfood.ie set of services via MyGovID Sep-18
    Dept. Justice and Equality;
    Dept. Employment Affairs & Social Protection
    Proof of Age Introduce the optional use of the PSC as an Age Card for use as a Proof of Age service Q3-18
    Dept. Foreign Affairs and Trade Passport
    Application
    All adult passport applications, new and renewals, for residents in Ireland will require applicants to be SAFE 2 registered; Online renewal of adult passports will use MyGovID Q4-18
  • 7. What are the advantages of SAFE Registration?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    SAFE Level 2 (SAFE 2) registration, used by the Department of Employment Affairs and Social Protection, allows a person to verify their identity once not just for access to services provided by the Department but also for an increasing number of public services provided by other State agencies – for example the Passport Office. As more public service providers move to using SAFE 2, people who are already registered to SAFE 2 will not need to repeatedly register their identity information when accessing public services.

    In addition once a person is registered to SAFE 2 they can be issued with a Public Services Card (PSC). This card is an easy to use means of verifying identity when collecting welfare payments and using services funded by the Department of Employment Affairs and Social Protection such as the free travel scheme. The PSC replaces other identity and entitlement tokens including the Social Welfare Services Card, the ‘pensions book’, and the paper free travel pass with one convenient identity card.

    SAFE 2 registration also protects the public interest by helping to minimise identity fraud and detect fraudulent claims in our welfare system.

  • 1. If I leave Ireland and emigrate permanently, can I request my SAFE registration be cancelled and deleted (i.e. exercise a Right to be Forgotten)?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    A SAFE registration is verification of a person’s identity and of their Public Service Identity dataset. Such details are relevant for potential future claims or entitlements (as are details of social insurance contributions made etc.) and for the continued security of the person’s identity (to prevent it being used fraudulently). Consequently, these details cannot be deleted. This is consistent with current data protection legislation and will, from May 2018, be compliant with Article 17 3(b) of the General Data Protection Regulation.

     

  • 2. Is the PSC an identity card?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Public Services Card is not a national ID card as it does not bear the characteristics of such a card. For example, it isn’t compulsory for a person to have one simply by virtue of being resident in the State (which it would be if it was a National ID). Most countries with a national ID card require people to carry it with them (in some cases at all times) – there is no such law in Ireland compelling people to carry the Public Services Card.

    Equally, it cannot be requested by any public or private body or person not included as a specified body in Schedule 5 of the Social Welfare Consolidation Act 2005 (as amended). In many countries operating a national ID card, private bodies are required by law to check a person’s identity through their national ID card before providing them with service, particularly in financial and insurance sectors. By contrast, the PSC can only be used by public bodies specified in the legislation and their agents in the context of conducting a public transaction with the person concerned. Therefore, the legislation narrows its application considerably and proves that the intent of the card has always been limited to the provision of public services.

  • 3. If I wish to make an access request to ascertain what personal data is held about me in the Single Customer View, to whom do I direct my request and how do you ensure that any inaccuracies are fully rectified?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Subject Access requests are dealt with in accordance with the guidance of the Data Protection Commissioner (as set out at https://www.dataprotection.ie/docs/ Making-an-Access-Request/963.htm) and should be sent to –

    Subject Access Requests,

    Department of Employment Affairs and Social Protection,

    Shannon Lodge,

    Carrick-on-Shannon,

    Co. Leitrim

    N41 KD81

    The identity of the person making the request must be verified before data will be provided. The data may be provided either electronically or in paper format as preferred by the requestor.

    Data on Single Customer View reflects the PSI data held on an individual by each contributor at the time of contact with the individual. If it is believed that inaccurate data is held by one of the contributing bodies, that body should be contacted to discuss any corrections.

  • 4. What is MyGovID and am I legally required to have a MyGovID account?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    A MyGovID account is a secure online account for accessing public services. The process for registering and using a MyGovID account proves in the online environment that the person has had their identity verified to the SAFE 2 standard. By using what is known as two factor authentication linked to the SAFE registration process MyGovID assures the privacy and security of online services. For example, people registered with a MyGovID account can request online access to their PRSI contribution record or can apply online for some welfare services. It is not mandatory for people to use these online services, it is an optional benefit provided to people who are registered to SAFE 2 level. A full description of MyGovID is available on the dedicated website www.mygovid.ie.

    In addition, the MyGovID secure online identity verification system is also essential for Ireland to be aligned with the EU eIDAS regulation, which is a key aspect of the EU’s eGovernment Action Plan and Digital Single Market Strategy. See Why do I need a PSC for MyGovID if my physical card is not read as part of the process of registration? also for more information on MyGovID.

  • 5. How is the data technically and organisationally secured by the controller?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Can I be confident that my personal identity/registration data is secure on this State register?

     

    The Department of Employment Affairs and Social Protection is committed to ensuring that data relating to customers is securely held and used only for relevant business purposes. The Department’s commitment to safeguarding data is reflected in its use of advanced data processing and storage technology hosted in secure datacentres and is reinforced by a range of legislative and administrative provisions that are designed to protect the rights and interests of our customers.

    These provisions include the Official Secrets Act 1963, the Data Protection Acts 1988 and 2003, the Social Welfare Consolidation Act 2005 and the Civil Service Code of Standards and Behaviour. They impose obligations in relation to the confidentiality of official data and the protection of records against unauthorised access, unnecessary use, alteration, destruction or disclosure.
    For these reasons –

    • the PSI data set is stored and maintained in the Department’s own secure datacentres using best-in-class data security systems;
    • the Single Customer View database is stored in a secure government data centre. Access to the data is tightly controlled and restricted to specified bodies on the private Government Network. All data access is logged and regularly audited;
    • access to the dataset is restricted to those members of staff who have a business need to reference the data;
    • all members of staff are reminded regularly through various awareness, education and training initiatives of data protection law and the primacy of client confidentiality, the obligations they have to maintain both, and the potential penalties that are applicable in respect of any breach;
    • all members of staff must, on an annual basis, sign undertakings that they have read, and will act in accordance with, data protection policies and guidelines;
    • staff that fail to comply with these guidelines are subject to disciplinary action (up to and including dismissal). In addition they may be subject to potential legal action including possible claim for compensation for distress/damage caused to the customer;
    • all accesses to the data are logged and are subject to independent audit;
    • Twenty eight security audits have been undertaken within the last five years (2012 – 2017), twenty two of these are completed, and six are in progress. Three Penetration tests, two Privacy Impact Assessments, and a Risk Assessment of the Information Systems environment were also carried out during this timeframe;
    • a dedicated Business Information Security Unit (BISU) is responsible for overseeing information security and data protection awareness and compliance across the Department,
      • BISU develops, reviews and communicates policies, guidelines and procedures covering the use of data to help effectively implement data protection legislation and information security best practice,
      • It supports business areas by providing advice on data protection and information security matters relevant to their work,
      • it works closely with our Information Technology staff on technical security matters, and
      • it provides a liaison function with the Office of the Data Protection Commissioner on data protection matters and policies.
  • 6. Must the PSC be carried at all times by individuals in the State and/or can any member of An Garda Síochána ask that the card be produced?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    It is not necessary to carry a Public Service Card at all times.

    An Garda Síochána is not a specified body under the Social Welfare Consolidation Act 2005 (as amended) – except in respect of its own members – and consequently cannot request the card from a person. In fact, it would be an offence for a member of An Garda Síochána to request a person’s PSC under Section 263 (4) of the Social Welfare Consolidation Act 2005 (as amended).

  • 7. Who is responsible for identity services and standards in the public service?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The SAFE standard, including the PSC and MyGovID platforms, are overseen and managed by a senior level Interdepartmental Implementation and Policy Group on Public Service Identity which is co-chaired by the Department of Public Expenditure and Reform and the Department of Employment Affairs and Social Protection. This group reports to the Civil Service Management Board. All decisions are subject to Government approval, and if required, to legislative change.

  • 8. The Government in 2013 committed to a review of the legal basis of the PPSN to ensure it remained aligned with the wider public service?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Has this review been conducted? What was the outcome? What are/were the terms of reference for the review?

    Who is completing the review?

     

    At present, the PPS Number is a restricted number for use by specified bodies and their agents in the conduct of public transactions with and for the person concerned and the functions of the specified body in accordance with the provisions of Section 262 of the Social Welfare Consolidation Act 2005 (as amended). The Government decision of September 2013 provided that the Department of Social Protection would lead a research and consultation exercise on the suitability of the current legal basis for the PPS Number and the making of recommendations. This examination is to include –

    1. The preparation of a paper on the experience in comparable countries, focussing in particular on the link between the restrictiveness of the legal framework and the associated levels of fraud;
    2. Consideration of any categories of service for which the collection of the PPSN should not be mandatory; and
    3. Consultation across a range of public service bodies, including all Departments, the Office of the Revenue Commissioners, the Office of the Data Protection Commissioner, the Central Statistics Office and the Central Bank.

    The initial task of examining and preparing a comparative report with other countries’ treatment of personal identity numbers, cards and eIDs in the provision of public services is underway but has not yet been completed. It is likely to be 2018 before this element of the examination will be complete. Once it is, a senior level Interdepartmental Group established by the Civil Service Management Board to oversee identity services in the public service will consider how best to progress the two other elements of the examination. In the meantime, the legislative basis referred to above maintains the PPS Number as a restricted number.

  • 9. How is the data shared?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    There are numerous means by which PSI data can be shared with specified bodies which include secure file transfers and application programming interfaces between systems, access to the contact chip on the PSC (see the responses to What PSI data is either stored on the card or appears on the front of the card? and What government entities and bodies can read a) the chip and/or b) the magnetic stripe on the card (PSC)?), access to the Single Customer View (see responses to the following question Q1, Q2, Q3, Q4, Q5, Q6, Q7), and use of the MyGovID online identity verification solution (see responses to What is MyGovID and am I legally required to have a MyGovID account? and Why do I need a PSC for MyGovID if my physical card is not read as part of the process of registration?).

  • 10. What company produces these cards and what safeguards are in place to safeguard the use of data by this company?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    For how long is the contract to be in place between the controller and the provider?

     

    The PSC is produced in Ireland by an Irish-registered company called Biometric Card Services (BCS) under contract to the Department. The current contract is due to expire at the end of 2017. That contract includes a number of conditions designed to safeguard the data. For example it is a condition of contract that all data and related services provision and operation be provided on-site in Ireland and subject to the terms of the Data Protection Acts and the jurisdiction of the Irish courts. All data to be personalised onto PSCs (i.e., transferred onto cards) is provided by the Department of Employment Affairs and Social Protection to BCS over the private Government Network. Before any data is transferred, the Department and BCS systems mutually authenticate each other. The data is encrypted so that no third party can access the data, and electronically signed so that BCS can be certain that the data originates from the Department and has not been modified en route. All of these processes are implemented using strong cryptography according to international and industry standards. Once PSCs are personalised the data used to so personalise them is not retained by BCS but is destroyed as an automatic part of the personalisation process in accordance with advice provided by the Office of the Data Protection Commissioner. In addition the systems used in the card production have been subjected to audit by external experts.

  • 11. Is it intended to increase the scope of the card beyond the Schedule 5 bodies as outlined in the legislation?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    At this time there are no plans to expand the range of specified bodies. Any increase in the number of specified bodies would have to be provided for in legislation and consequently would have to undergo Oireachtas scrutiny prior to enactment.

    One of the provisions set out in Section 5 of the Social Welfare, Pensions, and Civil Registration Bill 2017 would, if enacted, enable customers to volunteer their PSC where they wish to use it as a form of proof of identity and/or age. However, it is important to note that it would remain an offence for a non-specified body or person to request or demand the production of a PSC, or to access data held on the PSC. The proposed legislation would not change the number of specified bodies that can request the PSC. It would simply give individuals the option to use their PSC if they wished, as proof of identity and/or age, in transactions with nonspecified bodies.

  • 12. What data does An Post read off the PSC when it processes a social welfare payment?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    An Post, operating as an agent for the Department of Employment Affairs and Social Protection, is the only organisation that reads the Magnetic stripe for the purposes of accessing the PPS Number. The PPS number is used by the Post Office to make welfare payments to customers in post offices.

  • 13. What government entities and bodies can read a) the chip and/or b) the magnetic stripe on the card (PSC)?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    What data does An Post read off the PSC when it processes a social welfare payment?

     

    All specified bodies may, in law, read the contact chip and magnetic stripe on the PSC.

    However, the contact chip on the Public Services Card and a card reader communicate with each other by cryptographic means. Only card readers specifically programmed to accept the Public Services Card contact chip can do this. To date, no specified body has implemented that technology.

    The Free Travel version of the Public Services Card also contains a contactless chip. This contactless chip allows the Free Travel variant of the Public Services Card to be used across the National Transport Authority’s Integrated Ticketing System commonly known as LEAP. The application is designed to only interact with a ticketing system reader deployed by the National Transport Authority. No personal information on a customer is made available to any transport operator either inside or outside of the jurisdiction when the Public Services Card is used to interact with the ticketing system. Neither does the contactless chip interact with the contact chip.

    An Post, operating as an agent for the Department of Employment Affairs and Social Protection, is the only organisation that reads the Magnetic stripe for the purposes of accessing the PPS Number. The PPS number is used by the Post Office to make welfare payments to customers in post offices.

  • 14. When SAFE registration data is collected from individuals through government bodies, is that registration data kept on one centralised State register?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Department of Employment Affairs and Social Protection is the sole body in the State currently undertaking SAFE 2 registrations. During a SAFE 2 registration, those elements of the Public Service Identity dataset (see response to What is the Public Service Identity Set?) that are already held for that person are verified and updated as necessary, and missing elements are collected and verified. In that way, the Department holds a complete Public Service Identity dataset for each person that it has verified to SAFE 2 standard.

    As provided for in the Social Welfare Consolidation Act 2005 (as amended) any PSI data collected by another identified public service provider (being a ‘Specified Body’) can also be used, for the purpose of maintaining a person’s public service identity, i.e., their PSI dataset. For the purpose of enabling shared use of the PSI data elements with Specified Bodies the Department of Public Expenditure and Reform operates a facility known as the Single Customer View. This enables each Specified Body, in accordance with permissions granted by the Department of Employment Affairs and Social Protection, to access and use the PSI dataset. This in turn facilitates the re-use of the PSI dataset and the avoidance of customers having to resubmit the same identity information on multiple occasions.

    The Department of Employment Affairs and Social Protection is the data controller for the Single Customer View. Access to and use of data held in the Single Customer View database by other specified bodies is managed and controlled by the Department in accordance with the arrangements described at What governance arrangements are in place for the Single Customer View?.

  • 15. Why do I need a PSC for MyGovID if my physical card is not read as part of the process of registration?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    To use a verified MyGovID account a person’s identity must first be verified to the SAFE 2 standard. This is because MyGovID transfers elements of the person’s PSI to the Specified Body being accessed for the purposes of completing a transaction online. In addition, in the course of using MyGovID to access a public service, the customer may be permitted to view and change personal data held by that public body for the purposes of that transaction and their public function. Therefore, in order to protect a person’s personal details and transactions with public bodies in the online environment, it isn’t sufficient to simply provide a PPS Number and assert SAFE 2 compliance.

    As part of the application of the SAFE 2 standard in the online environment, we seek to ensure that a person’s MyGovID account is not used by another person. We do this by employing two-factor authentication each time the person uses the account. This means that, in addition to requesting a username and password (things you know), we send a one-time verification code to your verified mobile phone (something you have) which you must also provide when logging in.

    It isn’t necessary to get a MyGovID account when you verify your identity to the SAFE 2 standard (although we would strongly encourage it). It is possible to set up your account later and by remote means – in other words you don’t have to come back to a SAFE registration centre. For the same reasons as above we have to be sure that we link the account to the proper SAFE 2 verified PSI dataset. Accordingly we will check a number of things with you – some of the details of your PSC may be included in that check. Full details on MyGovID are available on the dedicated website www.mygovid.ie.

  • 16. What is the legal basis for the sharing of this data by departments, agencies and offices with the Single Customer View?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Single Customer View was developed to enable sharing of PSI data in accordance with Sections 262 (5) and 262 (6) of the Social Welfare Consolidation Act 2005 (as set out in the response to Is SAFE registration mandatory for all residents in Ireland?). In addition, the system facilitates the sharing of PSI data for control purposes in accordance with Section 261 of the Social Welfare Consolidation Act 2005 which states –

    “Information held by the Minister for the purposes of this Act or the control of schemes administered by or on behalf of the Minister or the Department of Social and Family Affairs may be transferred by the Minister to another Minister of the Government or a specified body, and information held by another Minister of the Government or a specified body which is required for those purposes or the control of any such scheme administered by another Minister of the Government or a specified body may be transferred by that Minister of the Government or the specified body to the Minister.”

  • 17. Who is the data controller for that State register?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Please include contact details for the relevant officer, where applicable.

     

    The Secretary General of the Department of Employment Affairs and Social Protection, Aras Mhic Diarmada, Store Street, Dublin 1 is the Data Controller for the PSI dataset held by the Department. As required under Section 16 of the Data Protection Acts 1988 and 2003 these details are listed on the Register maintained by the Data Protection Commissioner.

    Separately each specified body that collects or holds PSI data elements is the data controller in respect of their holding of the data on their own systems or databases. See the full list of specified bodies is included here.

  • 18. What Government entities can conduct SAFE registration?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    There are a number of State bodies specified in law in Schedule 5 of the Social Welfare Consolidation Act that can SAFE register a person. See Question 19 for more information on specified bodies.

    However, the Department of Employment Affairs and Social Protection is the sole body in the State that currently provides SAFE 2 registration. The Department provides this registration service at over 100 locations throughout the State including its Intreo centres and some dedicated SAFE registration centres.

  • 19. What is the legal basis for SAFE registration?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The main legal powers providing for and relating to SAFE registration are set out in the Social Welfare Consolidation Act, 2005 (as amended) as follows – Sections 262 and 263B provide for the verification of identity to facilitate the issuing and use of a Personal Public Services Number (PPS Number or PPSN).

    • Sections 262 and 263B provide for the verification of identity to facilitate the issuing and use of a Personal Public Services Number (PPS Number or PPSN).
    • Sections 263, 263A and 263B provide for the verification of identity to facilitate the issuing, use and cancellation of a Public Services Card (PSC).
    • Section 241 provides that a person must satisfy the Minister to his/her identity when making a new claim and sets out how that can be done.
    • Section 247C provides that an existing claimant must satisfy the Minister to his/her identity, sets out how that can be done, and provides for disqualification where an existing claimant fails to so do.

    A table providing more detail on the key legislative provisions can be found here.

  • 20. Is SAFE registration mandatory for all residents in Ireland?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    It is not mandatory for all people resident in Ireland to be SAFE 2 registered.

    However it is necessary, and has always been necessary, that people using high value public services are required to provide some proof of identity. Now, in order to ensure services are provided to the right person and to support efficient service delivery a growing number of public service providers are requiring that proof of identity is underpinned by the SAFE 2 identity verification standard.

  • 21. What is the Public Service Identity Set?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The public service identity (PSI) set used to verify a person’s identity comprises each person’s –

    • PPS Number
    • Surname
    • Forename
    • Date of birth
    • Place of birth
    • Sex
    • All former surnames (if any)
    • All former surnames (if any) of his or her mother
    • Address
    • Nationality
    • Photographic image
    • Signature
    • Date of Death, where relevant
    • Certificate of Death, where relevant
    • Any other information as may be required for authentication purposes that is uniquely linked to or is capable of identifying that person
    • Any other information that may be prescribed which, in the opinion of the Minister, is relevant to and necessary for the allocation of a Personal Public Service Number

    The PSI dataset is defined in Section 262 (1) of the Social Welfare Consolidation Act 2005 (as amended) and the individual data items are set out at Section 262 (3) of that Act.

    During a SAFE registration, some security questions are also asked and the answers to these are recorded – these are required as subsequent security checks when a person contacts the Department about their PSI data or their PSC.

    People are asked to answer only 2 of the following 10 security questions and leave the remainder blank.

    People are reminded that these questions may be used to assist in confirming a person’s identity when they contact the Department about their SAFE registration or their PSC so it is important that they can easily remember the responses they provided.

    Questions to choose from –

    1. What was your childhood nickname?
    2. What was the make of your first car?
    3. What was the surname of your best childhood friend?
    4. What is your maternal grandmother’s birth surname?
    5. Where was your first holiday?
    6. What is the middle name of your oldest child?
    7. What primary school did you attend?
    8. What is your oldest child’s birth month (e.g. January)?
    9. What was the location of your first employment?
    10. What is your favourite sport?
  • 22. Who are the bodies with whom the Department shares PSI data?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The full list of specified bodies that may use PSI data under Sections 260-265 of the Social Welfare Consolidation Act 2005 (as amended) is contained in Schedule 5 of the Social Welfare Consolidation Act and is included in the list of  Scheduled Bodies. Separately, those bodies that actually received Public Service Identity data in 2016 that was collected by the Department of Employment Affairs and Social Protection along with the relevant legislative basis under which they could access and use this data are listed here. Use of PSI data for specific purposes is also provided for in other legislation and these instances are outlined in this link.

  • 23. What governance mechanisms have been put in place to oversee and underpin the sharing of PSI data?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Will these arrangements be made public?

    The governance of the shared use of PSI data is set out in, and underpinned by, the Social Welfare Consolidation Act, 2005 (as amended). Section 262 of the Act sets out how the sharing and use of the PSI data is restricted to public service bodies specified in law or their agents (i.e., organisations working on their behalf or performing one of their public functions under contract). Designation as a specified body requires primary legislation and as such can only be done by an Act of the Oireachtas.

    The primary legislative basis for the sharing of PSI data is set out in Sections 262 (5) and 262 (6) of the Social Welfare Consolidation Act. Section 262 (5) provides that where a specified body collects any element of PSI data from a person in the course of a providing a service or undertaking a transaction, that information shall also be collected for the purpose of maintaining the person’s public service identity. This means that the dataset can be kept up to date by using data from the person’s most recent interaction with a specified body.

    Specific provision for other specified bodies using the PSI data collected by the Department is made in section 262 (6) which provides that “where a specified body has a transaction with a person, the Minister may share the person’s public service identity with the specified body to the extent necessary in respect of that transaction for authentication by the specified body of the person’s public service identity” and “a specified body may use a person’s public service identity in performing its public functions insofar as those functions relate to the person concerned.”

    Such specified bodies are in all cases required to process and store data in accordance with the Data Protection Acts.

  • 24. To whom can I direct a data protection access request under S4 of the Irish Data Protection Acts 1988 and 2003 if I wish to obtain a copy of my SAFE registration data including photograph?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    In what format will the data be issued to me - paper or electronically or do I have a choice?

    In what form is it held by the controller?

     

    The PSI dataset in respect of persons registered to SAFE 2 standard by the Department of Employment Affairs and Social Protection is held electronically in Ireland on the Department’s own IT systems based in secure datacentres owned and operated by the Department. The Single Customer View database is managed on behalf of the Department by the Department of Public Expenditure and Reform and is held electronically in a secure Government datacentre in Ireland.

    Access requests for data held directly by the Department of Employment Affairs and Social Protection or for data held on the Single Customer View database are dealt with in accordance with the guidance of the Data Protection Commissioner (as set out at https://www.dataprotection.ie/docs/Making-an-AccessRequest/963. htm) and should be sent to:

     

    Subject Access Requests,
    Department of Employment Affairs and Social Protection,
    Shannon Lodge,
    Carrick-on-Shannon,
    Co. Leitrim
    N41 KD81

    The identity of the person making the request must be verified before data will be provided. The data may be provided either electronically or in paper format as preferred by the person requesting the data.

  • 25. If I discover an inaccuracy in my data on receipt of a copy, to whom do I direct a request for rectification?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    While the Department makes every endeavour to ensure the accuracy of every person’s data, errors or outdated information can occur on occasion. The actions required to correct such inaccuracies depend on the nature of the inaccuracy as follows –

    DATA ITEM  ACTION REQUIRED
    Surname Attend at a SAFE registration centre
    Forename; Attend at a SAFE registration centre
    Date of birth Attend at a SAFE registration centre
    Place of birth Attend at a SAFE registration centre
    Sex Contact Officer in Charge, DQM section, Department
    of Employment Affairs and Social Protection,
    Shannon Lodge, Carrick-on-Shannon, Co. Leitrim
    All former surnames (if
    any)
    Attend at a SAFE registration centre
    All former surnames
    (if any) of his or her
    mother
    Attend at a SAFE registration centre
    Address or contact
    details e.g. phone no
    Notify the Department by phone or in writing or by
    calling into a Department of Employment Affairs
    and Social Protection office or online via MyWelfare/
    MyGovID.
    Nationality Attend at a SAFE registration centre
    A photograph of the
    person
    Attend at a SAFE registration centre
    The person’s signature Attend at a SAFE registration centre
  • 26. Are spouses and family members linked on the SAFE register, and if so, for what purpose may they be identified?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The PSI dataset does not contain relationship information and hence no relationship information is linked within the PSI dataset nor can it be shared with specified bodies for the purpose of identity verification.

  • 27. What is the legal basis for requiring SAFE 2 registration across public services?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The legal basis for requiring SAFE 2 identity verification for services provided by the Department of Employment Affairs and Social Protection is set out in the response to What is the legal basis for SAFE registration?. The legal basis for other public bodies accessing and sharing the PSI dataset is set out in the response to What governance mechanisms have been put in place to oversee and underpin the sharing of PSI data?.

    The legal basis for public bodies requiring SAFE 2 identity verification in the provision of their services is dependent on the nature of the legal, regulatory or administrative basis on which the service is being provided and the legal, regulatory or administrative procedures being operated in the provision of that service, i.e., it differs depending on the service and will be set out in the explanatory material for that service where SAFE 2 identity verification is required.

    By way of example, under the regulations governing the Driver Theory Test (DTT), the form of application for a DTT shall be in such form as the Road Safety Authority’s Driver Theory Test Service determines. As it is government policy that SAFE 2 registration is required for access to all services that require substantial proof of a person’s identity, and the PSC is proof of that registration, the service has exercised its right under the regulations and under Section 263 (3) of the Social Welfare Consolidation Act 2005 (as amended) to require the PSC as the appropriate form of ID. The Road Safety Authority, is a specified body under the Social Welfare Consolidation Act.

    Similarly Sections 6(2) and 7(2) of the Passports Act 2008 provide the legislative basis for the various information and documentation requirements for application for a passport. The Department of Foreign Affairs and Trade is a specified body under the Social Welfare Consolidation Act (as amended) and, as agreed by the Government earlier this year, is working towards ensuring that by the end of 2018 all passports issued to adults resident in the State are SAFE Level 2 compliant.

  • 28. Is SAFE 2 registration mandatory for users of public services not resident in Ireland?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    cPeople living abroad and in receipt of Irish public services are not being requested to be registered to SAFE Level 2 at this time.

  • 29. Is the Government seeking to create a complete “population register” through requiring SAFE registration? If so, why?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Government is not seeking to create a complete population register through requiring SAFE registration.

    Rather, SAFE Level 2 registration allows a person to verify their identity once for public service purposes to a substantial level of assurance. Consequently, it eliminates the need for a person to repeatedly register their identity information when accessing public services. It makes it more difficult for someone else to claim to be a person and so helps to eliminate “identity theft” and fraudulent access to those public services and/or to someone else’s data. Accordingly, verifying identity to a substantial level of assurance ultimately reduces the administrative burden both on public service providers and on individuals accessing their services. It also facilitates those providers in making their services, particularly those of a high-value or personal nature, available through online channels (which would not be possible otherwise).

  • 30. Is it sufficient for an individual to supply their PPS Number to a body once they are SAFE registered and not produce their PSC, particularly if that body is not physically reading the chip or magnetic stripe on the card?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    Once a person completes a SAFE 2 registration they can be issued with a Public Services Card (PSC) as a physical token that proves they have had their identity verified to the SAFE 2 standard (simply quoting a PPS Number does not prove a person’s identity nor does it prove that their identity has been verified to the SAFE 2 standard).

    It is a matter for each specified body to determine, subject to obtaining permission from the Department of Employment Affairs and Social Protection, if it wishes to access the PSI data stored on the PSC. However in most cases examination of the photographic image on the PSC and comparison of signature can validate that the card belongs to the holder.

    The presentation of the card also enables the service provider to rely on the data held in the Single Customer View and compare that data with data presented at the point of transaction by the customer.

  • 31. What PSI data is either stored on the card or appears on the front of the card?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The data that may be displayed on the PSC and electronically stored is set out at Sections 263 (1A) and Section 263 (1B) respectively of the Social Welfare Consolidation Act. The following sets out where each data item appears or is stored on the PSC –

    • the name of the person:
      • Face of PSC and Chip
    • the personal public service number (PPSN) of that person:
      • Rear of PSC, Chip, and Magnetic stripe
    • a photograph of that person:
      • Face of PSC and Chip
    • the signature of the person:
      • Face of PSC and Chip
    • the issue number of the public services card:
      • Rear of the PSC and Chip
    • the expiry date of the PSC:
      • Face of PSC and Chip
    • the date of birth of that person:
      • Chip and Magnetic stripe
    • the place of birth of that person:
      • Chip
    • the sex of that person:
      • Chip and Magnetic stripe
    • the nationality of that person:
      • Chip
    • all former surnames (if any) of that person:
      • Chip
    • all former surnames (if any) of the mother of that person:
      • Chip
  • 32. Does the Public Services Card store biometrics?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    No. While the card does store a person’s photograph it does not store the biometric or arithmetic template of that photograph. Nor is the biometric or arithmetic template of the photo stored in the PSI dataset or shared with other public bodies.

  • 33. What departments, agencies and offices feed data into the Single Customer View?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The single customer view combines PSI data held by the following contributors –

    • Department of Employment Affairs and Social Protection;
    • Department of Agriculture, Food and the Marine;
    • Department of Tourism, Transport and Sport;
    • Revenue Commissioners;
    • Health Service Executive (Primary Care Reimbursement Service); and
    • General Register’s Office (Death Registrations). The PSI data displayed will be that obtained by each contributor during their most recent transaction with the customer. This allows all specified bodies the opportunity to check the currency of their PSI data and a means of keeping it up to date.

    The PSI data displayed will be that obtained by each contributor during their most recent transaction with the customer. This allows all specified bodies the opportunity to check the currency of their PSI data and a means of keeping it up to date.

  • 34. What third parties have access to the data in the Single Customer View (SCV)?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    No ‘third parties’ have access to the Single Customer View. All Specified Bodies are legally entitled to access the Single Customer View.

    To date, the following Specified Bodies have been granted access to various services (see What government entities and bodies can read a) the chip and/or b) the magnetic stripe on the card (PSC)? for an explanation of these) on the Single Customer View as follows –

    • Department of Employment Affairs and Social Protection (PSI look-up and Control application)
    • Passport office (Department of Foreign Affairs and Trade) (PSI look-up)
    • Residential Tenancy Board (Control application)
    • Department of Justice (section that processes Naturalisation certificates) (PSI look-up)
    • Irish Prisons Service (PSI look-up)
    • Road Safety Authority (PSI look-up and PSI Reporting)
    • Revenue Commissioners (PSI Reporting)
    • Department of Education (PSI Reporting)
    • Pobal (PSI Reporting)
    • NTMA (PSI Reporting)
  • 35. Who is the State data controller of the “Single Customer View”?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    The Single Customer View is maintained in the Department of Public Expenditure and Reform on behalf of the Department of Employment Affairs and Social Protection. The Secretary General of the Department of Employment Affairs and Social Protection is the Data Controller.

  • 36. What governance arrangements are in place for the Single Customer View?
     

    Sorry No Irish Translation available For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.

    What safeguards are in place for the single customer view?

    For example, how do you ensure that entities providing information to the single customer view do not provide more information that is required under law. What mechanisms ensure that State entities do not have access to irrelevant or excessive personal data?

     

    The Single Customer View system supports four data services that can be accessed by Specified Bodies, viz.

    1. PPSN Checker which allows a specified body to validate a PPSN, Name, Address and Date of Birth in real-time – it simply confirms if the data input is valid or not;
    2. PSI Lookup which allows a specified body to lookup the PSI data for an individual based on PPS Number;
    3. PSI Reporting which facilitates specified bodies in comparing their PSI data with that held on the system to assist them with their overall PSI data quality; and
    4. Control which facilitates specified bodies to view and search all of the PSI information in the Single Customer View for control and/or fraud detection purposes.

    All specified bodies can access the PPSN checker (Item 1).

    However, the Department of Employment Affairs and Social Protection must formally approve access to the other three services. That approval is conditional on a business need being established and on the agreement to and implementation of rigorous data security and protection (both technical and business) protocols and standards. This includes the nomination of a Compliance Officer in the specified body who liaises with the Client Identity Services Division of the Department of Employment Affairs and Social Protection with respect to each element of the agreement. That Compliance Officer is responsible for managing the agreement, for nominating specific officers to access specific services on the Single Customer View, and for ensuring that each such officer signs an Officer User Agreement (this agreement sets out the officer’s responsibilities under Social Welfare legislation in relation to the use of the PPS number/Public Service Identity Data, and the Data Protection Acts 1988 and 2003).

    All accesses to the Single Customer View application are logged. Information is logged about what information was accessed, by whom, and when. The Office of the Government Chief Information Officer in the Department of Public Expenditure and Reform, the Client Identity Services Division of the Department of Employment Affairs and Social Protection and the user organisations management hierarchy can access all relevant access history on the Single Customer View.