Assess the applicable Article 9 exception: What missing control is most direct?
Biometric data used for unique identification are special-category data, so an applicable GDPR Article 9 exception must be assessed.
The question
Under the GDPR in the European Union, a hospital administration team proposes facial matching to uniquely identify patients at registration; the system provides no clinical advice. Lawful-basis analysis, security, and general privacy controls are otherwise complete. What missing control is most direct?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Apply encryption while retaining the identification purpose unchanged.Encryption protects biometric data but does not establish the special-category condition required for uniquely identifying patients.
- Treat the facial images as ordinary photographs.The stated unique-identification purpose makes the biometric processing special-category data, unlike photographs used without that purpose.
- Obtain ordinary consent from every patient.Consent may be relevant, but ordinary lawful-basis consent does not by itself establish the separate special-category exception required.
- Assess the applicable Article 9 exception. ✓Facial matching for unique identification processes biometric data as a special category, requiring assessment of an applicable Article 9 exception.
The trap
Classify biometric data by purpose: unique identification is decisive, while every photograph is not automatically biometric data. How to remember it
Biometric data used for unique identification are special-category data, so an applicable GDPR Article 9 exception must be assessed.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- Empower a qualified reviewer to examine evidence and alter: Which missing control most directly creates →
- Document the applicable Chapter V safeguard and supporting: Which missing control is most direct? →
- Define retention limits and a coordinated workflow: Which missing control most directly addresses both gaps? →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.
