Biometric Data (Article 4(14) GDPR)

Biometric data rank among the most sensitive categories of personal data, because they are inseparably linked to a person's physical identity. Article 4(14) GDPR defines them as personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.

1 Overview

Biometric data are not a standalone data category in the sense that certain bodily characteristics would become biometric data merely by virtue of their existence. What is decisive is the technical processing: it is only the collection and processing by specific means aimed at unique identification or authentication that elevates a characteristic to the level of Article 4(14) GDPR. In doing so, the definition covers three groups of characteristics:

• physical characteristics: fingerprints, hand geometry, facial geometry, iris structure, vein patterns
• physiological characteristics: DNA profile, odor, heart rhythm
• behavioral characteristics: voice, writing dynamics when signing, gait

Biometric data for the purpose of uniquely identifying a person fall under the special categories of personal data pursuant to Article 9(1) GDPR. Their processing is prohibited in principle and permitted only where one of the exhaustively regulated exceptions of Article 9(2) GDPR applies. For related term definitions, see Genetic Data (Article 4(13) GDPR) and Data Concerning Health (Article 4(15) GDPR).

2 Elements of the Definition

2.1 Specific Technical Processing as a Prerequisite

The central element is the use of specific technical processing during collection or processing. Without this technical step there is no biometric datum within the meaning of Article 4(14) GDPR, even if the underlying bodily characteristic would objectively be capable of identifying a person.

This has considerable practical significance for images: a passport photo that is simply stored and displayed is not yet a biometric datum. It becomes one only when it is processed with facial recognition software or similar biometric methods geared toward unique identification or authentication (Recital 51 GDPR). Under this standard, images in passports, identity cards, driver's licenses, and residence permits are biometric data only where the processing is carried out by such specific technical means.

2.2 Physical, Physiological and Behavioral Characteristics

The definition distinguishes three groups of characteristics without deriving different legal consequences from them. The group of behavioral characteristics is of practical importance because it is not confined to physically static properties. It includes in particular:

• Signature with writing dynamics: a mere copy or scan of a signature is not a biometric datum, because writing flow and writing pressure cannot be reconstructed from it. Where, by contrast, the signature is captured via a signature pad that records and analyzes speed, pressure, and movement pattern, a biometric datum exists.
• Voice: every person has a distinctive manner of speaking. Where the voice is processed for authentication purposes (for instance in voice biometrics systems), it constitutes a biometric datum.

2.3 Unique Identification or Confirmation

The processing must allow or confirm the unique identification of the person. Biometric methods that merely permit a rough assignment to a group (e.g. age, sex) therefore do not produce biometric data within the meaning of the definition, provided that no individual identification is sought or made possible.

3 Examples of Biometric Data at a Glance

The following table shows typical characteristics that are classified as biometric data under Article 4(14) GDPR as soon as they are processed by suitable technical methods.

4 Classification as a Special Data Category

4.1 General Prohibition of Processing

Biometric data used for the purpose of uniquely identifying a natural person fall under Article 9(1) GDPR. The processing of these data is prohibited in principle. It is permitted only where one of the exceptions exhaustively listed in Article 9(2) GDPR applies, such as explicit consent of the data subject (Article 9(2)(a) GDPR), a substantial public interest (Article 9(2)(g) GDPR), or a legitimate interest in the field of employment and social protection law (Article 9(2)(b) GDPR).

Details on the grounds for lawful processing under Article 9(2) GDPR can be found in the overview of sensitive data categories.

4.2 Opening Clause for Member States

Article 9(4) GDPR allows Member States to introduce or maintain additional conditions, including restrictions, with regard to genetic data, biometric data, and data concerning health. The German legislature has made use of this option, among other places, in the German Federal Data Protection Act (BDSG). On the scope of these national margins, see the page on the opening clause for Member State law.

4.3 Distinction: Biometric Data vs. Personal Data in General

Not every processing of bodily characteristics automatically leads to the applicability of Article 9 GDPR. What is decisive is whether the processing is aimed at unique identification. Where this purpose or the specific technical processing is absent, there is indeed a personal datum that must meet the general requirements of the GDPR, but not a biometric datum under Article 4(14) GDPR.