Assessing Biometric Processing Privacy

Assessing Biometric Processing Privacy

Overview

Biometric data is classified as a special category of personal data under GDPR Art. 9(1) when processed for the purpose of uniquely identifying a natural person. Processing biometric data on a large scale triggers a mandatory DPIA under Art. 35(3)(b). This skill provides a comprehensive DPIA methodology for biometric systems including facial recognition, fingerprint identification, voice recognition, iris scanning, vein pattern analysis, and behavioural biometrics (gait, typing patterns, signature dynamics).

Legal Framework for Biometric Data

GDPR Definition — Art. 4(14)

"'Biometric data' means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data."

Art. 9(1) — Prohibition on Processing Special Categories

Processing of biometric data for the purpose of uniquely identifying a natural person is prohibited unless one of the Art. 9(2) exemptions applies.

Critical distinction: Art. 9 only applies when biometric data is processed "for the purpose of uniquely identifying" a person. A photograph used for illustration purposes is not Art. 9 data; the same photograph processed through facial recognition software to identify the person is Art. 9 data.

Art. 9(2) Exemptions Applicable to Biometric Processing

Art. 35(3)(b) — Mandatory DPIA Trigger

Processing on a large scale of special categories of data referred to in Art. 9(1), including biometric data processed for unique identification, requires a DPIA. "Large scale" factors per WP248rev.01:

• Number of data subjects (in absolute terms or as a proportion of the relevant population)
• Volume of data and/or range of data items
• Duration or permanence of the processing
• Geographic scope

EDPB Guidelines 3/2019 on Video Surveillance

Key provisions relevant to facial recognition CCTV:

• Facial recognition in public spaces generally constitutes systematic monitoring of publicly accessible areas (Art. 35(3)(c)) in addition to large-scale biometric processing (Art. 35(3)(b)).
• Facial recognition for access control is less intrusive than identification in public spaces but still requires DPIA.
• Purpose limitation: biometric templates created for access control must not be repurposed for attendance monitoring or performance management.
• Storage limitation: biometric templates should be stored on a device controlled by the data subject (e.g., access card) rather than a central database where possible.

Biometric System Types and Risk Assessment

Verification (1:1 Matching)

One-to-one comparison of a live biometric sample against a stored template for the claimed identity. Used for access control, device unlock, payment authentication.

Identification (1:N Matching)

One-to-many comparison of a live biometric sample against a database of templates to determine identity. Used for law enforcement, border control, surveillance.

Categorisation

Classification of individuals into groups based on biometric characteristics (age, gender, ethnicity, emotion) without uniquely identifying them. Used for analytics, targeted advertising, audience measurement.

DPIA Content for Biometric Systems

Systematic Description

For biometric systems, the Art. 35(7)(a) systematic description must include:

Necessity and Proportionality for Biometric Processing

The proportionality assessment for biometric systems must be rigorous because biometric data:

• Is permanent (unlike passwords, biometric characteristics cannot be changed if compromised)
• Is uniquely identifying (biometric data is inherently linked to the individual)
• Creates heightened risk of function creep (biometric templates can be repurposed)
• Has disproportionate impact if breached (biometric data cannot be reissued)

Risk Register for Biometric DPIA

Common Biometric Processing Risks

Mitigation Measures for Biometric Processing

Enforcement Precedents

• CNIL vs Clearview AI (2022): EUR 20 million fine for mass collection of facial images from internet for biometric identification database without consent, transparency, or DPIA.
• ICO vs Clearview AI (2022): GBP 7.5 million fine for same biometric processing; enforcement notice ordering deletion of UK residents' biometric data.
• Swedish DPA vs Skelleftea Municipality (2019): SEK 200,000 fine for school using facial recognition for student attendance tracking. Consent relied upon was not freely given due to power imbalance. Less intrusive alternatives were available.
• ICO vs Serco Leisure (2022): Enforcement notice for requiring employees to use facial recognition for time and attendance at leisure centres. No DPIA conducted; no less intrusive alternative offered.
• CNIL vs Clearview AI (2023): EUR 5.2 million additional penalty for non-compliance with the 2022 order, demonstrating the consequences of continued biometric processing in violation of enforcement.
• French Conseil d'Etat vs Presto (2020): Upheld CNIL enforcement against biometric time-and-attendance system for employees; found that fingerprint scanning for attendance was disproportionate when badge systems were available.
• Italian Garante vs P&G (Gillette) (2022): Enforcement action against automated age estimation system using facial analysis in retail stores without DPIA and without valid consent.