A factory rolls out fingerprint scanners so each worker's attendance is uniquely identified. Beyond an Article 6 basis, what additional GDPR pathway does this biometric processing generally require?
Select an answer to reveal the explanation.
Short Explanation
Fingerprints that uniquely ID people are special-category data—not just another badge swipe. You need a valid Art. 6 basis and an Art. 9 condition. A cookie banner or "AI Act certificate" does not replace that pathway.
Full Explanation
Fingerprints used to uniquely identify workers are biometric data processed for the purpose of uniquely identifying a natural person, which Article 9 treats as special-category data. Beyond a valid Article 6 basis for the attendance processing, the controller generally needs an Article 9 condition—such as explicit consent where genuinely free (often difficult in employment), or another condition set out in Article 9(2) as specified by Union or Member State law (for example certain employment, social security, or substantial-public-interest pathways where applicable). Civic employers and private factories share the same special-category logic: unique biometric identification is not “ordinary HR data.”
A cookie banner is irrelevant; fingerprints are not ordinary contact data and cookie UI does not satisfy Article 9. An adequacy decision addresses international transfer tools under Chapter V, not on-premises timeclock lawfulness. EU AI Act conformity or certification may matter for some AI systems, but it does not replace the GDPR Article 9 pathway for special-category biometric identification.
Exam caveat: not every biometric measurement automatically engages Article 9—the GDPR’s biometric special-category trigger is tied to processing for unique identification. Still, attendance fingerprinting for unique ID is the classic in-scope example. Also separate security of processing (Article 32) from the lawfulness gateway.
Operational check: document Article 6 and Article 9 together, complete a DPIA for high-risk biometric monitoring, minimise templates and retention, control access to biometric stores, offer non-biometric alternatives where required by law or policy, and verify national employment/biometric rules before rollout—not after the scanners are bolted to the gate.