New public services digital wallet has security and privacy issues, say campaigners

Ireland's new digital wallet system, designed to serve as an identity verification tool for public services, has drawn criticism from civil liberties campaigners over potential security and privacy risks. The government-backed app, developed by the Department of Public Expenditure, relies on a person’s Personal Public Service (PPS) number and integrates with MyGovID, a service requiring enrollment in the Public Services Card (PSC) facial biometric database. Campaigners argue that the system poses significant legal and privacy challenges, citing concerns over data handling and user consent. The pilot scheme, set to begin next week, will initially offer the app to 10,000 individuals. While the use of the app is not mandatory, the government has emphasized that it aligns with EU requirements for a digital wallet for public services by the end of the year. The app aims to streamline access to public services through a centralized digital platform, reducing the need for physical identification documents. However, critics warn that the integration of MyGovID introduces vulnerabilities, particularly given the ongoing legal dispute involving the Data Protection Commission (DPC). The Irish Council for Civil Liberties (ICCL) and Digital Rights Ireland (DRI) have highlighted that obtaining a MyGovID account necessitates participation in the PSC facial biometric database, a process deemed unlawful by the DPC. These groups claim that the Department of Social Protection is challenging the DPC’s ruling in the High Court. They further assert that security measures surrounding MyGovID are inadequate and that the governance structure of the system lacks transparency, placing its legality in question. Campaigners have raised multiple concerns regarding the digital wallet, including the absence of a clear legal foundation for its operation, the reliance on MyGovID as the primary method of authentication, and the lack of accessibility for users without smartphones. Additionally, they have pointed to the potential misuse of the system for enforcing social media age restrictions, although such proposals have yet to progress beyond initial discussions. The groups have urged the Department of Public Expenditure to release key documentation, including the data protection impact assessment (DPIA), any reviews conducted by the DPC, the app’s source code, and a human rights impact assessment. Public consultations on the app revealed mixed responses, with some participants expressing worries about how their personal data might be handled. The pilot phase is intended to allow for iterative improvements and to showcase the app’s functionality and security features. The department has stated that feedback gathered during the trial will inform the final version of the application, aiming to address user concerns while ensuring compliance with regulatory standards. As the pilot launches, the debate over the digital wallet continues to intensify. Advocacy groups remain vigilant, emphasizing the importance of transparency and accountability in the management of sensitive personal information. With the legal challenge against the DPC’s findings still pending, the future of the digital wallet, and its implications for privacy and security, remains uncertain. The outcome of the court case and the results of the pilot program will likely shape the trajectory of Ireland’s digital transformation efforts in the coming months.