| name | biometric-dpia |
| title | Assessing Biometric Processing Privacy |
| description | Guides DPIA for biometric processing systems including facial recognition, fingerprint, voice, iris, and gait analysis. Covers Art. 9 special category requirements, Art. 35(3)(b) mandatory DPIA triggers for large-scale biometric processing, and EDPB Guidelines 3/2019 on video surveillance. Keywords: biometric, facial recognition, fingerprint, DPIA, Art. 9, special category, EDPB Guidelines 3/2019. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/biometric-dpia |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Assessing Biometric Processing Privacy
Overview
Biometric data is classified as a special category of personal data under GDPR Art. 9(1) when processed for the purpose of uniquely identifying a natural person. Processing biometric data on a large scale triggers a mandatory DPIA under Art. 35(3)(b). This skill provides a comprehensive DPIA methodology for biometric systems including facial recognition, fingerprint identification, voice recognition, iris scanning, vein pattern analysis, and behavioural biometrics (gait, typing patterns, signature dynamics).
Legal Framework for Biometric Data
GDPR Definition — Art. 4(14)
"'Biometric data' means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data."
Art. 9(1) — Prohibition on Processing Special Categories
Processing of biometric data for the purpose of uniquely identifying a natural person is prohibited unless one of the Art. 9(2) exemptions applies.
Critical distinction: Art. 9 only applies when biometric data is processed "for the purpose of uniquely identifying" a person. A photograph used for illustration purposes is not Art. 9 data; the same photograph processed through facial recognition software to identify the person is Art. 9 data.
Art. 9(2) Exemptions Applicable to Biometric Processing
| Exemption | Reference | Application to Biometrics |
|---|
| Explicit consent | Art. 9(2)(a) | Employee consent often not freely given due to power imbalance (WP29 Opinion 2/2017). Consumer biometric consent must meet Art. 7 standards. |
| Employment, social security, social protection law | Art. 9(2)(b) | Member State law may authorise biometric processing in the employment context (e.g., biometric access control for high-security areas). |
| Vital interests | Art. 9(2)(c) | Limited to emergency situations where biometric identification is needed to protect someone's life. |
| Substantial public interest | Art. 9(2)(g) | Member State law basis required. May apply to law enforcement biometrics where authorised by specific legislation. |
| Health or social care | Art. 9(2)(h) | Biometric patient identification in healthcare settings. |
| Public health | Art. 9(2)(i) | Biometric contact tracing during health emergencies (subject to proportionality). |
