Biometric templates used to uniquely identify staff are: Under GDPR, which analysis best fits processing this

Biometrics used to uniquely identify people are Article 9 special-category data needing a 9(2) condition, and the automated badge suspension engages Article 22 safeguards.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. Biometric templates used to uniquely identify staff are special-category data, so processing needs an Article 9(2) condition, and the auto-suspension must respect Article 22 limits on solely-automated decisions. ✓

   Correct: biometrics used for unique identification fall under Art. 9 and require a 9(2) condition, while an access-suspension decision made solely by the system engages Art. 22 safeguards.
2. Biometric templates count as ordinary personal data because they are only staff records, so a standard legitimate-interests basis lawfully covers both the biometric identity matching and the automated badge suspension here.

   Almost right on legitimate interests generally, but biometrics used to uniquely identify a person are Art. 9 special-category data, so legitimate interests alone is not a sufficient condition.
3. Because processing happens on-premises with no external transfer, Article 9 does not apply, and the operator only needs to log matches and publish a notice describing the depot-gate biometric system.

   Plausible because transparency notices matter, but Art. 9's special-category rules apply regardless of whether data leaves the site, so a lawful 9(2) condition is still required.
4. Since staff have an employment relationship, employer consent is presumed valid for Article 9, and the automated suspension is exempt from Article 22 because it is a routine security control measure.

   Plausible but employment consent is rarely freely given, and a routine-security label does not exempt a solely-automated decision with significant effect from Art. 22.

How to remember it

Biometrics used to uniquely identify people are Article 9 special-category data needing a 9(2) condition, and the automated badge suspension engages Article 22 safeguards.

More Understanding How Laws, Standards and Frameworks Apply to AI questions

• Complete a DPIA: Acting as the GDPR data controller, which combination of measures must be in place before →
• Copyright can restrict use of the scraped works: Considering intellectual property law and the EU AI Act →
• A materially lower selection rate for a protected group: Under nondiscrimination law, which conclusion is most →
• All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →