Data protection and biometrics

What counts as sensitive here

To confirm that a voter is a real, eligible and unique member, PollGuard may process: images of an identity document and the data read from it (including your national identification number and date of birth), a selfie used for face matching, a short liveness capture, data read from an e-ID chip over NFC, and fingerprint enrolment where your organisation enables it. Under the Data Protection Act, 2019 this is sensitive personal data.

How it is used

• Document checks — to confirm the document is genuine and the details match your membership record.
• Face matching — to compare your selfie with your document photograph, producing a similarity score.
• Liveness — to confirm a real person is present rather than a photograph or recording.
• Duplicate detection — to prevent one person enrolling as several members.
• Re-verification at voting — to confirm the person casting the ballot is the verified member.

Every automated check is reviewed by a human administrator before a verification is approved. You are never approved or rejected by a model alone, and you may ask for a decision to be reviewed.

Your phone’s identifier

When you register or verify your identity in the PollGuard Android app, the app reads your phone’s DRM identifier (the identifier video services use to recognise a phone). Only a scrambled form of it leaves your phone, and PollGuard stores only a further scrambled form, never the identifier itself. We use it for one thing: to stop one phone registering several people. If a phone is already registered to another member, it cannot register a different person unless an officer of your organisation approves a genuine case, such as a shared family phone, with the reason kept on the record. We keep it while your membership is active and for two years after it ends, then delete it. It is not shared with anyone (your organisation sees only that a phone is already registered, never the identifier), and it is not used for tracking or advertising.

Consent and alternatives

Verification is explained before it begins and you choose whether to proceed. If you do not want to be verified biometrically, contact your organisation — they remain responsible for offering a lawful alternative route to exercising your membership rights.

Retention

Verification material is kept only while needed to verify you and to resolve any dispute about the election in which it was used, then deleted. Scores and outcomes may be retained for audit purposes for longer than the underlying images.

Who sees it

Access is limited to administrators of your organisation who review verifications, and to PollGuard staff where necessary for support or security. Access is controlled by role and recorded.

Your rights

You may request access to your verification data, ask for corrections, ask for deletion, object to processing, or complain to the Office of the Data Protection Commissioner. To exercise any of these, contact us or your organisation’s administrator.

Transfers

Verification processing takes place on infrastructure we control. Where a sub-processor is involved in identity checks, they act on our instructions under contract and may not use your data for their own purposes.