My Department is committed to ensuring that customers’ personal data is securely held and used only for the purposes set out in legislation. The Public Services Identity dataset - which is provided for in social welfare legislation - is stored in databases maintained in my Department’s secure datacentres. Access to the dataset is restricted to those members of staff who have a business need to reference the data and all accesses to the data are logged. All members of staff must, on an annual basis, sign undertakings that they have read, and will act in accordance with, data protection policies and guidelines. My Department ensures oversight in relation to data protection by keeping records of data accesses which are then subject to audit.
The PSC is produced in Ireland by an Irish-registered company called Security Card Concepts. It was a condition of the award of contract that all data and related services provision and operations be provided on-site in Ireland and subject to the jurisdiction of the Irish courts. Once PSCs are personalised, the data used to personalise them is not retained by Security Card Concepts - rather it is destroyed in accordance with advice provided by the Data Protection Commission. In addition, the systems used in the card production have been subject to audit by external experts.
The PSC itself has multiple protection mechanisms, all of the highest current international standards, to prevent and detect tampering with the physical card and its contents. As well as some hidden security features, there are visual measures such as the overall graphical design, branding, microprinting, the use of optical variable ink and a kinegram.
I trust this clarifies the matter for the Deputy.