A privacy officer is reviewing an AI system that uses biometric data to authenticate employees for access to secure areas. Under GDPR, how is biometric data classified?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — biometric data used to uniquely identify employees is special category data under GDPR Article 9, so you need explicit consent or another Article 9 basis. Treating it as ordinary personal data misses the extra legal restrictions.
Full Explanation
Biometric data processed to uniquely identify individuals is special category data under GDPR Article 9, requiring an Article 9 basis such as explicit consent or employment law necessity. Calling it ordinary personal data with security measures is incomplete because special category status adds extra restrictions. Calling it pseudonymous data usable under legitimate interests without restriction is wrong, and calling it non-personal automated data is wrong.