When do the images of biometric characteristics qualify as special categories of data under the GDPR?: a systemic approach to biometric data processing

Abstract

As legal scholars observed, the definition of biometric data in the GDPR is not aligned with the technical definition in the international standards, which define biometric data as biometric samples, or aggregation of them at any stage of processing. The legal definition excludes the images of biometric characteristics from the sensitive data regime under Article 9 (special categories of data). If not considered sensitive, the images of characteristics can be processed based on a broad category of legal grounds, such as legitimate interests, including marketing purposes under Article 6. This article looks beyond the technical and legal definitions of biometric data and interprets the GDPR in two ways to address the confusing status quo. First, it dissects the objective nature of the data under the sensitive data regime of the GDPR. Second, it will systemically inquire about the meaning of purpose and how it can help us understand the margins of the sensitive data regime.