Biometric data

Under Article 4(14) GDPR, biometric data are personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that person. Where biometric data are processed for the purpose of uniquely identifying a person, the special protection requirements of Article 9 GDPR apply.

What information qualifies as biometric data?

Biometric methods use individual characteristics of a person to establish or confirm their identity.

Both physical characteristics and certain behavioural characteristics may be taken into account.

Typical examples include:

• Fingerprints: The capture and technical analysis of characteristic features of the fingertips.
• Facial geometry: The analysis of individual facial features using facial recognition systems.
• Iris patterns: The analysis of the characteristic structures of the iris.
• Retinal patterns: The analysis of specific characteristics of the retina.
• Hand geometry: The measurement of individual characteristics of the hand.
• Voice characteristics: The technical analysis of characteristic features of the voice for identification or authentication purposes.

What matters is not merely the existence of a physical characteristic, but its processing by means of a specific technical procedure that allows or confirms the unique identification of a person.

An ordinary photograph or a simple voice recording is therefore not automatically biometric data within the meaning of Article 4(14) GDPR.

Only the corresponding technical processing may result in the creation of biometric data for the purposes of data protection law.

When are biometric data classified as special categories of personal data?

Article 9(1) GDPR includes biometric data among the special categories of personal data where they are processed for the purpose of uniquely identifying a natural person.

As a general rule, such processing is prohibited, subject to the exceptions laid down by law in Article 9(2) GDPR.

One such exception may apply where the data subject has given their explicit consent to the processing for one or more specified purposes.

Other statutory exceptions may also apply, provided their respective requirements are met.

In addition to an exception under Article 9(2) GDPR, there must generally be an appropriate legal basis under Article 6(1) GDPR.

Not every instance of processing a photograph or voice recording is automatically subject to the special prohibition on processing.

For example, the ordinary storage of an employee photograph does not, by itself, trigger the application of Article 9 GDPR merely because the person's face can be recognised in it.

However, if the photograph is processed using a specific facial recognition procedure for the purpose of uniquely identifying the person, the additional requirements of Article 9 GDPR may apply.

How are biometric data used by businesses?

Biometric methods are used in particular to identify individuals or confirm their identity.

Typical areas of application include:

• Access control: Access to buildings or particularly secure areas using fingerprints or facial recognition.
• Access to IT systems: Authentication of users based on biometric characteristics.
• Identity verification: Matching biometric characteristics against stored reference data.
• Security applications: Verifying the identity of authorised individuals in particularly secure areas.
• Time recording: Recording working hours using biometric identification methods.

However, the technical ability to identify someone biometrically does not mean that using such technology is lawful under data protection law.

In particular, where employees are concerned, it must be assessed whether the processing is necessary for the specific purpose and can be based on a sound legal basis.

Where less intrusive methods are available, such as access cards or personal passwords, this may weigh against the necessity of using a biometric procedure.

The lawfulness of such processing therefore always depends on the circumstances of the particular application.

What data protection requirements apply to biometric methods?

Businesses must comply with the general data protection principles under the GDPR when processing biometric data.

These include, in particular, lawfulness, purpose limitation, data minimisation, storage limitation, and integrity and confidentiality under Article 5 GDPR.

It must also be taken into account that certain physical characteristics cannot readily be changed when biometric methods are used.

If biometric reference data fall into unauthorised hands, this may create particular risks for the data subjects concerned.

Under Article 32 GDPR, controllers must therefore implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These may include, in particular:

• Restricting access to biometric data
• Encrypting stored and transmitted information
• Storing biometric reference data in a decentralised manner wherever possible
• Using appropriate protection mechanisms for biometric templates
• Establishing appropriate retention and deletion periods
• Regularly reviewing the security measures in place

A biometric template is a digital reference generated from biometric characteristics and used, for example, for comparison during subsequent authentication.

Such templates may also constitute personal data and special categories of biometric data.

Under Article 35 GDPR, a data protection impact assessment (DPIA) may also be required where the intended processing is likely to result in a high risk to the rights and freedoms of natural persons.

Practical example: Fingerprint scanner for access control

A business intends to introduce fingerprint scanners to control access to its office premises.

Until now, employees have used personal access cards.

The business expects the biometric solution to simplify administration and wants to prevent access cards from being passed on to unauthorised individuals.

As fingerprints are to be processed for the purpose of uniquely identifying employees, this involves special categories of personal data under Article 9(1) GDPR.

Before introducing the system, the business must assess whether an appropriate legal basis under Article 6 GDPR and an exception under Article 9(2) GDPR apply.

It must also examine whether the intended security purpose could be achieved by less intrusive measures.

If the existing access card system provides sufficient security, it may not be possible to establish that biometric processing is necessary.

legal data assessment: Businesses should not introduce biometric methods solely because of their technical advantages or greater convenience. The decisive factors are the specific necessity of the processing, a sound legal basis and appropriate security measures. Particularly in the employment context, it is advisable to carefully assess possible alternatives before using fingerprints or other biometric characteristics for identification purposes.

Legal bases

Articles 4(14), 5, 6, 9, 25, 32 and 35 GDPR; supplemented in particular by Recital 51 GDPR and, where applicable, relevant national provisions on employee data protection, provided their applicability and statutory requirements are met.