CIPP/E Study Guide
Ch 15.6 - Biometric data

Biometric data as special-category data

Last reviewed:

Biometric data is defined in Article 4(14) as personal data from specific technical processing of physical, physiological or behavioural characteristics that allow or confirm unique identification (e.g. facial images, fingerprints). It exists as raw data or a biometric template. Its two main uses are identification (who are you?) and authentication (are you who you claim to be?). Crucially, it is Article 9 special-category data only when the purpose is to uniquely identify a person - otherwise it is ordinary personal data.

Two main uses of biometric systems
UseQuestion answeredExample
IdentificationWho are you?Facial recognition of individuals in social-media photos
AuthenticationAre you who you claim to be?Fingerprint to unlock a device, or palm print to enter a secure area
The Article 9 trigger is purpose

Biometric data is special-category data under Article 9 only when processed for the purpose of uniquely identifying a natural person. A facial photo used merely to permit access alongside other information does not engage Article 9 - but it remains personal data by definition.

  • Examples: DNA, fingerprints, palms, vein patterns, retina and iris patterns, odour, voice, face, handwriting, keystroke technique and gait
  • Biometric data may be raw (the image of a face or fingerprint) or in template form (a digital representation of extracted features)
  • A template must hold enough detail to identify the individual from the stored population
  • Member states may impose further restrictions on processing biometric data - check national law

Key terms - quick answers

What is “Biometric data”?
Article 4(14): personal data from specific technical processing of physical, physiological or behavioural characteristics that allow or confirm unique identification (e.g. facial images, dactyloscopic/fingerprint data).
What is “Biometric template”?
A digital representation of the distinct characteristics extracted from raw biometric data (e.g. minutiae location and direction for a fingerprint).
What is “Identification”?
Using biometrics to answer 'who are you?' - e.g. facial recognition on social-media photos.
What is “Authentication”?
Using biometrics to answer 'are you who you claim to be?' - e.g. a fingerprint to unlock a device.

Keep going - free

Every study note on this site is free. So are these: