A retail shop uses facial recognition to match customers against a shoplifter watchlist. Which characterisation best captures the GDPR risk level?
Select an answer to reveal the explanation.
Short Explanation
Face-matching shoppers to a watchlist is not “just another camera.” Biometrics for identification are special-category, high-stakes processing. You need strict legal conditions—not a casual loss-prevention plugin.
Full Explanation
Processing biometric data for the purpose of uniquely identifying a natural person is special-category processing under Article 9 and attracts heightened conditions. Retail facial recognition against watchlists is systematically intrusive and has been a focus of EDPB and SA scrutiny. Controllers must establish a valid Article 9 condition, assess necessity and proportionality, and typically conduct a DPIA with strong safeguards—or avoid the practice where it cannot be justified.