Facial templates are biometric special-category data: Which characterization of this processing under GDPR is
Facial templates that uniquely identify a worker are biometric special-category data whose processing is prohibited unless a specific Article 9 exception with safeguards applies.
The question
A company wants to deploy facial recognition to log employee attendance, generating facial templates that uniquely identify each worker. Which characterization of this processing under GDPR is correct?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Facial images are ordinary personal data, so the standard lawful bases suffice on their own.Plausible but wrong: biometric identification data is special-category, so the ordinary lawful bases alone are not enough without an Article 9 condition.
- Biometric data may be processed freely once employees are informed through a privacy notice.Plausible but wrong: notice supports transparency but does not lift the special-category prohibition, which requires an Article 9 exception.
- Special-category processing is always lawful where the employer simply relies on legitimate interests.Plausible but wrong: legitimate interests is an Article 6 basis and cannot by itself satisfy the Article 9 conditions required for special-category data.
- Facial templates are biometric special-category data, barred unless an Article 9 exception applies. ✓Correct: biometric data used to uniquely identify a person is special-category data, whose processing is prohibited unless a specific Article 9 exception plus safeguards apply.
The trap
Assuming an Article 6 lawful basis or a privacy notice alone authorizes biometric processing, when Article 9 imposes an additional gate. How to remember it
Facial templates that uniquely identify a worker are biometric special-category data whose processing is prohibited unless a specific Article 9 exception with safeguards applies.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- Complete a Data Protection Impact Assessment before: Before the processing begins, which GDPR controller →
- Copyright can bar using protected works as training data: Which of the following is an example of how →
- Nondiscrimination law: Which body of law is most directly implicated? →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.
