New public services digital wallet has security and privacy issues, say campaigners

Government app criticised for ‘weak’ security and ‘opaque’ governance and reliance on MyGovID for verification

Ireland is required under EU law to have a digital wallet for public services by the end of the year. Image: gov.ie
Ireland is required under EU law to have a digital wallet for public services by the end of the year. Image: gov.ie

The design of Ireland’s new digital wallet system raises significant legal and privacy concerns, civil liberties campaigners have said.

The Government smartphone app is designed to act as an ID verification tool.

Under plans being rolled out by the Department of Public Expenditure, the app, which is based around a person’s PPS number, is being made available to 10,000 people as part of a pilot scheme from next week.

Ireland is required under EU law to have a digital wallet for public services by the end of the year. The use of the app will not be compulsory and older forms of ID will still be usable.

However, the Irish Council for Civil Liberties (ICCL) and Digital Rights Ireland (DRI) have said they are concerned about the app’s reliance on MyGovID as the primary way for people to verify themselves and get a wallet.

In order to get a MyGovID account, you must have a public services card, which requires you to enrol in the PSC facial biometric database, the groups have said.

“This has been found to be unlawful by the Data Protection Commission [DPC]. This matter is currently before the High Court as the Department of Social Protection is appealing that DPC decision,” they said.

Security protections on MGovID are “weak”, and the governance of it is “opaque”, the groups said, putting its use “on very shaky legal grounds”.

In a letter to the department, the groups raised several concerns about the wallet, including what it called the “lack of legal basis” for it, using MyGovID as the anchor credential, wallet access for people without a smartphone, transparency and public trust, and the reported use of it for a social media ban for under-16s.

State’s digital wallet plan is a gift for cybercriminals and a data privacy nightmareOpens in new window ]

The digital wallet came to public attention earlier this year after Ministers suggested it could be used to comply with social media age limits, though proposals for age verification for under-16s have not advanced.

They have also called on the department to publish the wallet’s data protection impact assessment (DPIA), any review of the DPIA by the Data Protection Commissioner, the wallet’s source code and a human rights impact assessment.

The Department of Public Expenditure has been asked for comment.

A public consultation on the app has taken place, with some people raising concerns about how their data would be used.

The pilot scheme is being rolled out next week, which the department says will help co-design the final app and demonstrate its safety.

  • Join The Irish Times on WhatsApp and stay up to date

  • Sign up for push alerts to get the best breaking news, analysis and comment delivered directly to your phone

  • Listen to In The News podcast daily for a deep dive on the stories that matter

Niamh Towey

Niamh Towey

Niamh Towey is Education Correspondent at The Irish Times