A privacy officer is reviewing an AI system that uses biometric data to authenticate employees for access to secure areas. Under GDPR, how is biometric data classified?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because biometric data processed for the purpose of uniquely identifying individuals is explicitly listed as special category data under GDPR Article 9, requiring one of the specific Article 9 legal bases (explicit consent, employment law necessity, etc.) — a higher bar than ordinary personal data. A is correct but incomplete — the special category classification adds additional restrictions beyond ordinary security measures.
Full explanation below image
Full Explanation
B is correct because biometric data processed for the purpose of uniquely identifying individuals is explicitly listed as special category data under GDPR Article 9, requiring one of the specific Article 9 legal bases (explicit consent, employment law necessity, etc.) — a higher bar than ordinary personal data. A is correct but incomplete — the special category classification adds additional restrictions beyond ordinary security measures. C and D are factually incorrect.