Guidelines 03/2019 on processing of personal data through video devices
Section 5.1 General considerations when processing biometric data
73. The use of biometric data and in particular facial recognition entail heightened risks for data subjects’ rights. It is crucial that recourse to such technologies takes place with due respect to the principles of lawfulness, necessity, proportionality and data minimisation as set forth in the GDPR. Whereas the use of these technologies can be perceived as particularly effective, controllers should first of all assess the impact on fundamental rights and freedoms and consider less intrusive means to achieve their legitimate purpose of the processing.
74. To qualify as biometric data as defined in the GDPR, processing of raw data, such as the physical, physiological or behavioural characteristics of a natural person, must imply a measurement of this characteristics. Since biometric data is the result of such measurements, the GDPR states in its Article 4.14 that it is “[…] resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person,which allow or confirm the unique identification of that natural person[…]”. The video footage of an individual cannot however in itself be considered as biometric data under Article 9, if it has not been specifically technically processed in order to contribute to the identification of an individual.
75. In order for it to be considered as processing of special categories of personal data (Article 9) it requires that biometric data is processed “for the purpose of uniquely identifying a natural person”.
76. To sum up, in light of Article 4.14 and 9, three criteria must be considered:
Nature of data : data relating to physical, physiological or behavioural characteristics of a natural person,
Means and way of processing: data “resulting from a specific technical processing”,
Purpose of processing: data must be used for the purpose ofuniquely identifying a natural person.