IrelandGDPR Article 9 and Data Protection Act 2018 Section 46, Special Categories of Personal Data in Employment and Social Welfare Law in Ireland
Regulation (EU) 2016/679, Art. 9; Data Protection Act 2018 §46
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Consent, Biometric
- Audit expectation
- none
What it requires
- Where you process special category data, including biometric data, about an employee in Ireland on the ground that employment or social welfare law gives you or the employee a right or obligation, take suitable and specific measures to safeguard the employee's fundamental rights and freedoms, under Data Protection Act 2018 Section 46.
- Treat any biometric identifier your system derives through its own technical processing as General Data Protection Regulation (GDPR) Article 9 special category data, whether or not the source photo or audio was publicly available.
These lines are LexLint's reading of the law's text. Also read by: Data Protection Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
GDPR Article 83(5)(a): the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, applies to infringement of the basic principles for processing, including the Article 9 special category conditions.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland's supervisory authority under the GDPR and the Data Protection Act 2018.
Enforcement record
Counts the large scale statutory inquiries the Data Protection Commission finalised in calendar year 2025 (4), per the Commission's own press release announcing its 2025 Annual Report, published . The fines imposed that year included two fines totalling EUR 530 million against TikTok Technology Limited over transfers of EEA user data to China, and a EUR 550,000 fine against the Department of Social Protection over biometric facial matching in the Public Services Card registration process; the release's own stated total of fines for the year is just over EUR 530.77 million. Public enforcement actions only, counted from the Commission's own announcement rather than a private tracker; the release does not restate a cumulative total since 2018. This is the regime's own enforcement record, not specific to this instrument.
- As of
- Currency
- EUR
- Source link
- https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
- Fines per year
- 530,770,000
- Actions per year
- 4
Settledness
- As of
- Guidance link
- https://www.dataprotection.ie/en/organisations/know-your-obligations/lawful-processing/special-category-data
- Guidance body
- Data Protection Commission
- Open questions
- Is an employer's processing of biometric data to identify an employee, for example to record attendance, necessary for exercising or performing a right or obligation conferred by employment law under Section 46 of the Data Protection Act 2018, or does it need another Article 9(2) condition?
What it makes you log
Logging duty
Section 46 makes the processing of special-category data lawful for employment and social welfare law purposes if suitable and specific safeguards are taken; it names no log, record or documentation. GDPR Article 9 is a prohibition with exceptions and sets no record duty of its own.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) governs special categories of personal data, biometric data among them.
The DPA 2018 defines special categories of personal data as personal data revealing the racial or ethnic origin of the data subject, the political opinions or the religious or philosophical beliefs of the data subject, or whether the data subject is a member of a trade union, genetic data, biometric data for the purposes of uniquely identifying an individual, data concerning health, or personal data concerning an individual's sex life or sexual orientation.
Section 46 addresses processing special category data, including biometric data, in the employment and social-welfare context: the processing is lawful where it is necessary for exercising or performing a right or obligation conferred or imposed by law on the controller or the data subject in connection with employment or social welfare law (the GDPR Article 9(2)(b) condition), with suitable and specific measures safeguarding the data subject.
No dedicated Irish provision on voiceprint capture, retention, or destruction specifically was found; the GDPR baseline, that a voiceprint captured through specific technical processing for identification is special category data on the same footing as a faceprint, governs by default.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .