Why biometric data needs special care
Biometric data – fingerprints, facial geometry, iris patterns, voice prints – is uniquely powerful and uniquely risky. Unlike a password, you cannot reset your face. That permanence is exactly why European law treats biometric data as one of the most protected categories, governed both by the GDPR and, since 2025, by the EU AI Act. Companies experimenting with facial recognition, biometric access control or voice authentication need to understand both regimes before they deploy anything.
Biometric data under the GDPR
Under the GDPR, biometric data used for the purpose of uniquely identifying a person is a special category of personal data under Article 9. Processing it is prohibited unless a specific exception applies – most commonly the individual’s explicit consent, or a substantial public interest or employment-law basis set out in EU or national law.
Two points trip companies up. First, consent must be freely given, which is hard to achieve in the workplace where the power imbalance between employer and employee is real. Second, not every use of a camera or fingerprint sensor is Article 9 processing – the special-category rules bite when the purpose is unique identification. A general photograph is ordinary personal data; running it through facial-recognition matching is biometric processing.
Biometric practices under the EU AI Act
The AI Act adds a second layer aimed at the systems that process biometric data. Some uses are outright prohibited from 2 February 2025, including untargeted scraping of facial images to build recognition databases, biometric categorisation that infers sensitive attributes such as race or political views, and emotion recognition in the workplace and in education (with narrow safety and medical exceptions).
Real-time remote biometric identification in publicly accessible spaces is banned for law enforcement save for tightly defined exceptions. Many other biometric systems – including remote identification and biometric categorisation that are not prohibited – are classified as high-risk, which brings the full weight of conformity, oversight and deployer obligations that apply from 2 December 2027. That date was moved from 2 August 2026 by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026.
How the two regimes fit together
The GDPR asks whether you may process the data at all and on what basis; the AI Act asks whether the system doing the processing is permitted and, if so, how it must be built and used. You have to satisfy both. A biometric access system might have a valid Article 9 basis under the GDPR yet still be a high-risk AI system requiring conformity assessment and human oversight – or, in some configurations, be prohibited outright.
Praktiskt exempel
A logistics company wants to replace keycards with facial recognition at its warehouse. Under the GDPR it needs a lawful basis; employee consent is fragile, so it must look for an alternative and offer a non-biometric fallback. It must run a data protection impact assessment because the processing is high-risk. Under the AI Act, the recognition system is likely high-risk, triggering oversight and logging duties – and if the vendor also markets an emotion-detection add-on for staff, that feature is prohibited. The compliant answer is often a narrower deployment with a card or PIN alternative.
Vanliga misstag som företag gör
The classic error is relying on employee consent as if it were solid. Another is skipping the data protection impact assessment, which is effectively mandatory for biometric monitoring. Companies also forget the storage-limitation principle and keep biometric templates far longer than needed, or store the raw image rather than a protected template. Finally, many buy a system without checking whether any of its features fall into the AI Act’s prohibited list.
Rekommenderade åtgärder
Before any biometric project, identify the exact purpose and confirm whether it amounts to unique identification. Choose a lawful basis that does not lean on shaky consent, and always offer a non-biometric alternative. Run a data protection impact assessment and, where the AI Act applies, an assessment of the system’s risk classification. Minimise what you store, protect templates with encryption, set short retention periods, and screen the product for any prohibited functionality before signing.
Vanliga frågor
Can we require employees to use fingerprint access?
Rarely without friction. Because consent is hard to make free in employment, you generally need another lawful basis and a genuine non-biometric alternative. A blanket mandate is likely to fail.
Is a photo on a staff pass biometric data?
Not by itself. It becomes biometric data under Article 9 when it is processed for unique identification, for example by facial-recognition matching.
Is emotion recognition allowed at work?
No. The AI Act prohibits emotion recognition in the workplace and in educational settings, apart from narrow safety and medical exceptions, from February 2025.
Slutsats
Biometric data sits at the sharp end of two of Europe’s most demanding laws. The GDPR restricts when you may process it, and the EU AI Act restricts and regulates the systems that do the processing – sometimes banning them entirely. Handled carelessly, biometric projects invite fines and lost trust; handled well, they can be both compliant and useful. Lawgent advises companies on lawful bases, impact assessments and AI Act classification for biometric systems, so you can innovate without crossing a legal line.
