Biometric data is data resulting from specific technical processing relating to physical, physiological or behavioural characteristics which allows or confirms the unique identification of a person.
Examples
Typical biometric data includes fingerprints, facial geometry, iris and vein patterns and voice or typing behaviour, provided they are analysed by technical means.
An ordinary photograph is not automatically biometric data. It only becomes biometric data when it is processed using specific technical means, for example by facial recognition software.
Legal consequences
Where biometric data is processed for the purpose of unique identification, it belongs to the special categories of personal data. Processing is then only permitted under the conditions of Art. 9(2) GDPR, often only with explicit consent.
In the employment context, for example for time recording by fingerprint, particular restraint is called for, as less intrusive means are usually available.
Legal provisions
- Art. 4(14) GDPR
- Definition of biometric data.
- Art. 9(1) GDPR
- Biometric data for unique identification as a special category.
- Recital 51 GDPR
- Photographs are only biometric data if processed through specific technical means.
Related terms.
Health data Health data is personal data relating to the physical or mental health of a person which reveals information about their health status. Art. 4(15) GDPR Employee data protection Employee data protection comprises the rules governing the processing of personal data of job applicants, employees and former employees. Art. 88 GDPR 