Biometric data governance in Ireland
Govern the actual processing operation: why a face or other characteristic is collected, whether technical processing uniquely identifies or verifies a person, what template is created, who can access it and when it is deleted.
GDPR defines biometric data and gives special-category treatment where biometric data is processed for uniquely identifying a person. Specific legal analysis depends on purpose, method and context.
For: DPOs, privacy counsel, security, model governance and identity-product teams. This is independent information, not legal, compliance or security advice.
Data map
- Reference portrait from document or source.
- Live image or video and capture metadata.
- Derived template or embedding.
- Similarity, liveness and attack scores.
- Decision, reviewer record and audit log.
- Training, testing or fraud-network copies.
Governance record
- Purpose, necessity and legal basis/condition analysis.
- Controller and processor roles.
- Threshold, accuracy and demographic evidence.
- Security, encryption, access and separation.
- Retention, deletion, backups and subprocessors.
- Alternative, explanation, correction and appeal.
Purpose change risk
An image collected to verify one onboarding should not quietly become material for product development, surveillance, deduplication across clients or advertising. Treat every secondary use as a separate documented decision.
Procurement evidence
Require the provider to describe templates, matching, model improvement, geographic processing, support access and deletion for the exact service. Contract language must align with the configured technical flow.
Evidence and limits
MyID separates enacted rules, official implementation material, testing and vendor claims. A source can establish what its publisher says; it does not prove that every product, deployment or interpretation works as claimed. Where Irish implementation remains unsettled, this page says so.
Sources checked 22 August 2026. Re-check the linked primary material before making a consequential decision.
Next useful pages
Follow the Irish evidence
Get the business briefing when Irish wallet, verification and age-assurance evidence changes.
Join the business briefing