The facial data is a special category: Under GDPR, why does this processing face a stricter standard than

Biometrics used to uniquely identify a person are special-category data, so processing is barred unless an Article 9 condition applies.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. The facial data is pseudonymized, so an added layer of technical safeguards is recommended before use

   Plausible-sounding but wrong: identifying someone from a face is not pseudonymization, and that is not the trigger.
2. The facial data is publicly available, so the balancing test under legitimate business interests must be documented

   Incorrect framing: employee facial images are not public, and legitimate interests does not lift the Article 9 bar.
3. The facial data is a special category, so processing is prohibited unless a specific Article 9 condition applies ✓

   Correct: biometrics used to uniquely identify a person are special-category data needing an Article 9 condition.
4. The facial data is used for security, so a mandatory retention schedule of the images must be published

   A security purpose does not change the classification; retention rules are separate from the special-category standard.

How to remember it

Biometrics used to uniquely identify a person are special-category data, so processing is barred unless an Article 9 condition applies.

More Understanding How Laws, Standards and Frameworks Apply to AI questions

• Carrying out a data protection impact assessment before: Before deployment, which GDPR controller obligation →
• Whether the copyright holders retain rights that can limit: Which intellectual property consideration most →
• Disparate impact: Under nondiscrimination law, which theory of liability is most directly implicated? →
• All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →