A factory rolls out fingerprint scanners so each worker's attendance is uniquely identified. Beyond an Article 6 basis, what additional GDPR pathway does this biometric processing generally require?
Select an answer to reveal the explanation.
Short Explanation
Fingerprints that uniquely ID people are special-category data—not just another badge swipe. You need a valid Art. 6 basis and an Art. 9 condition. A cookie banner or "AI Act certificate" does not replace that pathway.
Full Explanation
GDPR Article 9(1) generally prohibits processing biometric data for the purpose of uniquely identifying a natural person unless an Article 9(2) condition applies (and Member State law may add rules). Attendance systems that authenticate workers via fingerprints engage that special-category regime in addition to needing a lawful Art. 6 basis. Cookie notices, adequacy decisions (transfer tools), and AI Act obligations do not substitute for the Art. 9 condition when unique identification biometrics are processed.