Assess the Article 9 exception and another lawful basis: Which procurement issue is decisive?
Facial matching for unique identification triggers biometric special-category analysis; procurement must verify an Article 9 exception and lawful basis.
The question
Under the EU GDPR, a software supplier proposes matching employees’ facial images against an access list to identify individuals uniquely. Which procurement issue is decisive?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Require ordinary image-security controls only.Security controls remain relevant, but unique identification makes the facial data biometric special-category data requiring further Article 9 analysis.
- Assess the Article 9 exception and another lawful basis before procurement. ✓Biometric data used for uniquely identifying people generally falls under Article 9, requiring an applicable exception alongside a lawful basis.
- Classify every supplier photograph as special-category data automatically.A photograph is not automatically special-category biometric data; purpose and processing context determine whether unique identification occurs.
- Use employee consent as the procurement approval criterion.Consent may be relevant in some circumstances, but it is not automatically valid or sufficient without Article 9 and other GDPR conditions.
The trap
Focus on the identification purpose and processing method, then analyze Article 9 separately from the ordinary lawful basis. How to remember it
Facial matching for unique identification triggers biometric special-category analysis; procurement must verify an Article 9 exception and lawful basis.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- A trained decision-maker independently examines relevant: Which review arrangement is meaningful? →
- Documented adequacy or Chapter V safeguards: What evidence is missing? →
- Verify the retention exception and process the rights: What should it do first? →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.
