GDPR Article 9
Definition
The EU General Data Protection Regulation provision classifying biometric data used for unique identification as a special category requiring explicit consent or an enumerated legal basis.
- Jurisdiction
- European Union
- Regulation
- General Data Protection Regulation
- Classification
- Biometric data for unique identification is a special category
- Requirement
- Explicit consent or an enumerated legal basis
Common questions
What counts as biometric data 'used for unique identification' under Article 9?+
Data such as fingerprint templates, facial recognition vectors, or iris scans processed specifically to identify a single individual falls within the special category; a photograph stored without any matching or identification processing generally does not trigger the same heightened protection.
How does Article 9's consent requirement affect law-enforcement biometric databases operating in the EU?+
Law-enforcement processing is typically governed by separate legal instruments rather than GDPR consent directly, but private companies building or supplying biometric identification tools used in or affecting the EU still need an Article 9 legal basis, which is why commercial facial-recognition deployments there face additional scrutiny.
Why does Article 9 matter to a forensic case involving a commercial face-recognition tool?+
If the underlying database or matching tool was built by scraping or processing biometric data without a valid Article 9 basis, evidence or leads derived from that tool can face legal challenge in EU-connected proceedings on data-protection grounds, independent of the identification's technical accuracy.
Related terms
- Aadhaar
- India's national biometric identity programme, administered by UIDAI. Links a 12-digit UID to 10 fingerprints, iris scans, and a facial photograph for...
- BIPA
- Illinois Biometric Information Privacy Act (740 ILCS 14, 2008). Requires informed written consent before collecting biometric identifiers and prohibits their sale. The...
- Clearview AI
- New York company that built a face-recognition database of approximately 30 billion images scraped from public websites without consent; subject to BIPA...
- GEDmatch
- A consumer genealogy database founded in 2010, used in the Golden State Killer investigation. Changed from opt-out to opt-in for law-enforcement access...
- Investigative Genealogy
- A technique that searches consumer ancestry DNA databases using crime-scene SNP profiles to identify candidate relatives of an unknown contributor, then uses...
- Liveness Detection
- A biometric system component that distinguishes a live biological sample from an artefact-based spoof. Methods include blood-flow detection, ridge flexibility measurement, and...
- NAFRS
- National Automated Facial Recognition System; India's NCRB-administered national facial recognition platform for law enforcement, progressively deployed from 2020 onward.
- NIST FRVT
- The National Institute of Standards and Technology Face Recognition Vendor Testing programme, the primary independent benchmark for facial recognition algorithms, publishing ongoing...
- Presentation Attack (Biometric)
- An attempt to deceive a biometric capture device using an artefact (silicone overlay, printed photograph, 3D mask) rather than a genuine biometric...