A gym considers fingerprint door entry and asks how EDPB materials should factor into the assessment. What is the best practice answer?
Select an answer to reveal the explanation.
Short Explanation
When the EDPB writes about biometrics, that is study-hall material for your gym door plan—not optional fan fiction. Use those guidelines with the real Article 6/9 analysis. Soft law still steers hard decisions.
Full Explanation
When a gym considers fingerprint door entry and asks how EDPB materials should factor into the assessment, best practice is that EDPB guidelines and opinions should inform the biometric processing assessment alongside GDPR Articles 6 and 9, necessity, and risk analysis. Soft law from the Board steers how supervisors expect high-risk biometrics to be justified in everyday access control. Saying EDPB guidelines may be ignored because gyms are private clubs outside EU soft law fails—guidance still shapes accountability narratives before SAs. Claiming only national tax guidance matters fails by swapping the wrong soft-law corpus. Asserting EDPB materials replace any Article 6 or 9 analysis fails—soft law informs but does not erase binding articles. Exam caveat: EDPB guidance is not itself a statute, yet ignoring it on biometrics weakens demonstrable compliance; controllers still need concrete Article 9 conditions and DPIA-quality reasoning. Operational check: read relevant EDPB biometric/access-control themes, run necessity alternatives (cards, PINs), complete DPIA if proceeding, document Article 6/9 bases, and prefer less intrusive access methods where feasible. In public-interest terms, documenting the lawful analysis, assigning owners, and retaining evidence of how individuals were protected is how organisations demonstrate accountability when supervisory questions arrive.