Biometric data governance in Ireland
Govern the actual processing operation: why a face or other characteristic is collected, whether technical processing uniquely identifies or verifies a person, what template is created, who can access it and when it is deleted.
GDPR defines biometric data and gives special-category treatment where biometric data is processed for uniquely identifying a person. Specific legal analysis depends on purpose, method and context.
For: DPOs, privacy counsel, security, model governance and identity-product teams. This is independent information, not legal, compliance or security advice.
Data map
- Reference portrait from document or source.
- Live image or video and capture metadata.
- Derived template or embedding.
- Similarity, liveness and attack scores.
- Decision, reviewer record and audit log.
- Training, testing or fraud-network copies.
Governance record
- Purpose, necessity and legal basis/condition analysis.
- Controller and processor roles.
- Threshold, accuracy and demographic evidence.
- Security, encryption, access and separation.
- Retention, deletion, backups and subprocessors.
- Alternative, explanation, correction and appeal.
Purpose change risk
An image collected to verify one onboarding should not quietly become material for product development, surveillance, deduplication across clients or advertising. Treat every secondary use as a separate documented decision.
One-to-one verification still needs legal analysis
Calling a system 'verification, not identification' does not settle its GDPR treatment. A manual look at an ordinary photograph is not automatically the same processing operation as creating a facial template to verify a unique identity. Assess the data, technical processing and purpose. Where Article 9 applies, identify an applicable condition in addition to the Article 6 basis.
Recruitment limits
Do not assume an applicant's agreement to a face check is freely given when refusal may affect access to a job. Define a non-biometric route, human review and deletion before deployment. Keep recruitment images out of unrelated monitoring, cross-client matching and model training unless a separate, lawful and transparent assessment supports that use.
Procurement evidence
Require the provider to describe templates, matching, model improvement, geographic processing, support access and deletion for the exact service. Contract language must align with the configured technical flow.
Evidence and limits
MyID separates enacted rules, official implementation material, testing and vendor claims. A source can establish what its publisher says; it does not prove that every product, deployment or interpretation works as claimed. Where Irish implementation remains unsettled, this page says so.
- General Data Protection Regulation
- Data Protection Commission
- NIST SP 800-63A-4 identity proofing
- EDPB Guidelines 05/2020 on consent
Sources checked 5 October 2026. Re-check the linked primary material before making a consequential decision.
In this topic: Buying, privacy and implementation
How should a buyer define, procure, pilot and govern identity services?
View all 12 pages in this topic
Next useful pages
Follow the Irish evidence
Get the business briefing when Irish wallet, verification and age-assurance evidence changes.
Join the business briefing