IrelandGDPR Article 9 and Data Protection Act 2018 Section 46, Special Categories and Employment Biometric Data in Ireland
Regulation (EU) 2016/679, Art. 9; Data Protection Act 2018 §46
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 May 2018.
A sensitive categories rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Where you process special category data, including biometric data, about an employee in Ireland, ground it in a legitimate argument tied to vital interests or another Article 9(2) condition with a public-interest character, and put suitable and specific safeguarding measures in place, under Data Protection Act 2018 Section 46.
- Treat any biometric identifier your system derives through its own technical processing as General Data Protection Regulation (GDPR) Article 9 special category data, whether or not the source photo or audio was publicly available.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
GDPR Article 83(5)(a): the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, applies to infringement of the basic principles for processing, including the Article 9 special category conditions.
- Rule
- Higher of
- As of
- 2 September 2026
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland's supervisory authority under the GDPR and the Data Protection Act 2018.
Enforcement record
Counts the Data Protection Commission's finalised large scale statutory inquiries that resulted in an administrative fine in calendar year 2025 (4), per the Commission's own press release announcing its 2025 Annual Report, published 2026-06-30: two fines totalling EUR 530 million against TikTok Technology Limited over transfers of EEA user data to China, and a EUR 550,000 fine against the Department of Social Protection over biometric facial matching in the Public Services Card registration process; fines_per_year of just over EUR 530.77 million is the release's own stated total for the year. Public enforcement actions only, counted from the Commission's own announcement rather than a private tracker; the release does not restate a cumulative since-2018 total, so total_fines is not recorded here. This is the regime's own enforcement record, not specific to this instrument.
- As of
- 2 September 2026
- Currency
- EUR
- Source link
- https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
- Fines per year
- 530,770,000
- Actions per year
- 4
What it reaches
Excludes recording-derived identifiersNo
Obligation class
Consent, Biometric
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
General Data Protection Regulation (GDPR) Article 9(1) governs biometric data as a special category, and the DPA 2018 explicitly lists biometric data among the special categories it elaborates on.
Section 46 addresses processing special category data, including biometric data, in the employment and social-welfare context: the processing is lawful where it is necessary for exercising or performing a right or obligation conferred or imposed by law on the controller or the data subject in connection with employment or social welfare law (the GDPR Article 9(2)(b) condition), with suitable and specific measures safeguarding the data subject.
No dedicated Irish provision on voiceprint capture, retention, or destruction specifically was found; the GDPR baseline, that a voiceprint captured through specific technical processing for identification is special category data on the same footing as a faceprint, governs by default.
When LexLint raises it
processes_biometricsprocesses_voicehigh_risk_decisions
Read the law
Official Journal text, EUR-Lex, Regulation (EU) 2016/679
Data Protection Act 2018 §46
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.