Data protection and staff consent
Biometric data is sensitive personal data under the Data Protection Act, 2019. So organisations must have a lawful reason to collect it, tell staff what is collected and why, keep it secure and delete it when no longer needed. In some cases, a data protection impact assessment is expected. The Office of the Data Protection Commissioner publishes guidance. In addition, offer an alternative, such as a card, for staff who cannot enrol.





