A system, method and program product for communicating a privacy policy associated with a reference template. The method includes assigning a first identifier for identifying a reference template created from biometric data collected, defining a second identifier for identifying a privacy policy that indicates a level of protection to be provided by a relying party requesting access to the reference template, the second identifier including an accept-reject provision for controlling the proper use and handling of the biometric data, cryptographically binding the reference template to the privacy policy and transmitting, responsive to a request received from the relying party, the accept-reject provision for the reference template, where based on a response received from the relying party to the accept-reject provision for the privacy policy, the reference template is either transmitted or not transmitted to the relying party.