It is a special category of data whose processing is: Under the GDPR, how is the biometric data used for that
Biometric data used to uniquely identify a person is a special category under GDPR Article 9, prohibited unless a specific condition applies.
The question
A retailer plans to deploy facial-recognition cameras that match shoppers against a watchlist to uniquely identify individuals. Under the GDPR, how is the biometric data used for that unique identification generally classified?
Preparing for AIGP? Take the free 5-min readiness quiz →
- It is ordinary personal data that any of the six standard lawful bases can justify without any additional safeguards.Plausible but wrong: an Article 6 lawful basis alone is insufficient; identifying biometrics also need an Article 9 condition.
- It is a special category of data whose processing is prohibited unless a specific Article 9 exception is satisfied. ✓Correct: biometric data processed to uniquely identify a person is a special category under Article 9, prohibited absent a listed condition.
- It is non-personal technical data because facial templates are mathematical vectors rather than photographs of people.Wrong: encoding a face as a vector does not remove its status as personal, indeed special-category, data.
- It is exempt from the regulation entirely provided the retailer deletes each captured video frame right after matching.Wrong: prompt deletion is a minimization measure, not an exemption from GDPR's special-category rules.
The trap
Believing an ordinary Article 6 lawful basis is enough to process identifying biometric data. How to remember it
Biometric data used to uniquely identify a person is a special category under GDPR Article 9, prohibited unless a specific condition applies.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- The controller must use only processors that provide: Under data protection obligations on controllers, what →
- Reproducing copyrighted works to assemble a training set: Which intellectual-property consideration most →
- Disparate-impact liability can arise from a facially: Under nondiscrimination law, why can this still create →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.
