Under the General Data Protection Regulation, biometric data used to identify a person is treated as a special category: processing it is prohibited by default, and lawful only when a narrow exception in Article 9 applies. Fingerprints, facial recognition templates, iris scans, voice profiles, and similar identifiers all fall inside this regime, which layers strict security, impact assessment, retention, and breach rules on top of the usual GDPR obligations. Get it wrong and the fine ceiling is €20 million or 4% of worldwide annual turnover, whichever is higher, and regulators have already imposed the maximum.
What Counts as Biometric Data
Article 4(14) defines biometric data as personal data “resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.”1General Data Protection Regulation (GDPR). Art. 4 GDPR – Definitions Two elements have to be present together: the data relates to physical or behavioral characteristics, and it has been put through a specific technical process that enables unique identification.
Physical biometrics include fingerprint templates, facial recognition geometry, and iris scans. Behavioral biometrics also qualify when processed for identification: gait analysis, typing rhythm, and voice modulation profiles all sit inside the definition.2Information Commissioner’s Office. Key Data Protection Concepts
An important boundary catches many organizations off guard. Recital 51 states that photographs “should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.”3General Data Protection Regulation (GDPR). Recital 51 – Protecting Sensitive Personal Data A staff photo in a directory is just a photo. Feed that same image into facial recognition software to open a door, and it becomes biometric data with the full weight of Article 9 attached.
The Default Ban and the Exceptions That Unlock Processing
Article 9 begins from prohibition. Processing biometric data “for the purpose of uniquely identifying a natural person” is banned unless one of ten listed exceptions applies.4General Data Protection Regulation (GDPR). Art. 9 GDPR – Processing of Special Categories of Personal Data The organization has to identify and document which exception it relies on before collecting anything. Three come up most often:
- Explicit consent, meaning a clear affirmative statement that is freely given, specific, and informed. “Freely given” is the hardest part to establish, especially in settings where the person may feel they cannot refuse.
- Employment and social protection obligations, where processing is necessary to carry out a legal obligation in employment or social security law, but only where domestic law specifically authorizes it and includes appropriate safeguards.4General Data Protection Regulation (GDPR). Art. 9 GDPR – Processing of Special Categories of Personal Data
- Substantial public interest, where processing rests on EU or Member State law that is proportionate to the aim and includes specific safeguards.4General Data Protection Regulation (GDPR). Art. 9 GDPR – Processing of Special Categories of Personal Data
The burden of proof sits on the controller. If a supervisory authority asks, the organization has to show that biometric processing was the least intrusive way to reach a legitimate goal. Boilerplate privacy notices and vague appeals to security do not survive that test.
Why Workplace Biometrics Are the Enforcement Hotspot
Fingerprint scanners for timekeeping and face recognition for building access are the most common real-world uses of biometric data, and they are where enforcement actions most frequently land. Employers have a natural power imbalance over employees, which makes “freely given” consent very hard to establish. If the only alternative to scanning a fingerprint is losing the job, that consent is not free in any meaningful sense.
In February 2024, the UK’s Information Commissioner’s Office ordered Serco Leisure to stop using facial recognition and fingerprint scanning for employee attendance, finding the processing was neither necessary nor proportionate when swipe cards or PIN codes were available. Serco was given three months to end the biometric processing and destroy the data. A general legal obligation to track hours, the ICO said, does not amount to a specific legal obligation to track them biometrically.
Employers considering biometric systems should document why non-biometric alternatives are genuinely insufficient, offer a real alternative to employees who object, and complete a Data Protection Impact Assessment before switching anything on. Convenience and preventing buddy-punching are operational preferences, not legal grounds under Article 9(2)(b).
When You Need a Data Protection Impact Assessment
Article 35 requires a Data Protection Impact Assessment whenever processing is likely to result in a high risk to individuals’ rights and freedoms. Biometric identification used at scale or in public-facing contexts almost always crosses that threshold.5General Data Protection Regulation (GDPR). Art. 35 GDPR – Data Protection Impact Assessment The assessment has to be done before processing begins.
A DPIA must describe the planned operations and their purposes, evaluate whether the collection is necessary and proportionate, identify specific privacy risks and their severity, and set out the technical and organizational measures that will mitigate those risks. It is the honest test of whether biometric processing is actually justified.
Where the assessment shows high residual risks the organization cannot adequately mitigate, Article 36 requires formal prior consultation with the relevant supervisory authority before processing starts.6European Commission. When Is a Data Protection Impact Assessment (DPIA) Required The authority has up to eight weeks to advise, extendable by six weeks for complex cases, and can block the processing during that period.7General Data Protection Regulation (GDPR). Art. 36 GDPR – Prior Consultation Skipping consultation when a DPIA flags high residual risk is itself a compliance violation.
How Biometric Templates Have To Be Secured
Article 32 requires security “appropriate to the risk,” and the risk with biometric data is unusually high because the identifiers are permanent. A leaked password can be reset in seconds. A leaked fingerprint template cannot be reset at all. The regulation names four categories of measures: pseudonymization and encryption; ongoing confidentiality, integrity, availability, and resilience of processing systems; the ability to restore access after an incident; and regular testing of the measures’ effectiveness.8General Data Protection Regulation (GDPR). Art. 32 GDPR – Security of Processing
In practice, storing raw biometric images or unprotected templates is almost never adequate. Organizations should store derived templates or hashed representations rather than the original samples, encrypt them at rest and in transit, and keep biometric data separate from other identifying information so that a single breach does not hand an attacker everything.
How Long You Can Keep It
Article 5(1)(e) requires that personal data be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.”9General Data Protection Regulation (GDPR). Art. 5 GDPR – Principles Relating to Processing of Personal Data The GDPR does not set a specific retention period for biometric data. The organization has to define its own schedule tied to the purpose and delete once the purpose is done.
The practical consequence is direct. When an employee leaves, the fingerprint template on the door lock has to go. When a customer cancels a service that used face verification, the scan goes with them. Keeping templates “just in case” breaches the storage limitation principle. Automatic deletion triggers and a documented retention policy that an auditor can review are the baseline.
What Happens After a Breach
Articles 33 and 34 govern breach notification, and both carry extra weight when biometric data is involved. The controller has to notify the competent supervisory authority “without undue delay and, where feasible, not later than 72 hours” after becoming aware of the breach, unless it is unlikely to result in a risk to individuals.10General Data Protection Regulation (GDPR). Art. 33 GDPR – Notification of a Personal Data Breach to the Supervisory Authority Any processor involved has to alert the controller without undue delay as well.
The notification has to describe the nature of the breach, the approximate number of affected individuals and records, the likely consequences, and the measures taken or proposed.10General Data Protection Regulation (GDPR). Art. 33 GDPR – Notification of a Personal Data Breach to the Supervisory Authority Because biometric identifiers cannot be replaced, a biometric breach will almost always be high risk, which means Article 34 also kicks in: affected individuals have to be told directly, not only the regulator. Every breach must be documented internally regardless of whether the notification thresholds are met.
Access and Erasure Rights
Article 15 lets individuals confirm whether an organization is processing their biometric data and obtain a copy of it along with details of the purposes and categories held.11General Data Protection Regulation (GDPR). Art. 15 GDPR – Right of Access by the Data Subject Article 12(3) sets the response deadline at one month from receipt, extendable by two more months for complex requests, provided the individual is told about the extension within the first month.12General Data Protection Regulation (GDPR). Art. 12 GDPR – Transparent Information, Communication and Modalities
Article 17 gives the right to erasure. Individuals can demand permanent deletion of their biometric templates when the data is no longer needed for its original purpose, or when they withdraw consent and no other legal ground applies.13General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure (Right to Be Forgotten) The controller has to act without undue delay and notify any third parties who received the data. For biometric templates, that means chasing down third-party processors, backup systems, and sub-processors that may still hold copies.
Using Outside Vendors
Access control systems, identity verification platforms, and payment authentication tools are often outsourced to specialist vendors. Article 28 requires that the arrangement be governed by a binding contract specifying the subject matter, duration, nature, and purpose of processing, along with the type of data and categories of data subjects.14General Data Protection Regulation (GDPR). Art. 28 GDPR – Processor
The processor has to assist with access and erasure requests, apply the Article 32 security measures, keep everyone with access under confidentiality obligations, and submit to audits by the controller. At the end of the contract, the processor must delete or return all biometric data and destroy remaining copies unless law requires retention. A processor cannot engage a sub-processor without the controller’s prior written authorization, and if the sub-processor fails, the original processor remains fully liable. If a processor starts making its own decisions about the purposes or means of processing, it is reclassified as a controller and picks up the corresponding liability.14General Data Protection Regulation (GDPR). Art. 28 GDPR – Processor
Sending Biometric Data Outside the EEA
International transfers add a separate layer. The GDPR permits transfers only where the destination has been recognized by the European Commission as providing adequate protection, or where appropriate safeguards such as Standard Contractual Clauses are in place.15European Commission. Data Protection Adequacy for Non-EU Countries
For US transfers, the EU-US Data Privacy Framework allows certified US organizations to receive personal data from the EU under a Commission adequacy decision, with a first periodic review published in October 2024.15European Commission. Data Protection Adequacy for Non-EU Countries Its long-term stability is uncertain because previous EU-US mechanisms were struck down by the Court of Justice of the European Union.
Organizations using Standard Contractual Clauses for biometric transfers must complete a transfer impact assessment on the destination country’s legal framework. Given the sensitivity and irreversibility of biometric identifiers, supplementary technical measures such as strong encryption and pseudonymization matter especially for cross-border flows.16European Commission. Standard Contractual Clauses
Penalties and What Regulators Have Actually Done
Article 9 violations sit in the highest fine tier: up to €20 million or 4% of total worldwide annual turnover in the preceding financial year, whichever is higher.17General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines Authorities weigh the nature and gravity of the infringement, whether it was intentional or negligent, how many people were affected, the steps taken to mitigate harm, and the level of cooperation with the regulator.
Clearview AI shows how those numbers translate into practice. The French data protection authority (CNIL) imposed the maximum €20 million fine on the company for scraping facial images from the internet without a legal basis, ordered the deletion of data belonging to individuals residing in France within two months, and attached a penalty of €100,000 per day of delay past that deadline.18European Data Protection Board. The French SA Fines Clearview AI EUR 20 Million Italian and Greek authorities issued comparable fines against the same company. The GDPR’s extraterritorial reach is not theoretical: an organization outside the EU that processes biometric data of people inside it faces real enforcement.
Fines are not the only tool. Supervisory authorities can order processing to stop entirely, require deletion of all collected biometric data, and impose ongoing compliance audits. For a business built around biometric identification, a stop order can be existential.