A stolen password can be changed; a fingerprint cannot. That is the main reason biometric data receives special protection. We use it every day to unlock our phones or authorise payments, but more and more often it is also requested by gyms, offices, schools and access services. Understanding when the request is legitimate and which safeguards to demand is essential.
What biometric data is
Article 4(14) of Regulation (EU) 2016/679 defines biometric data as personal data resulting from specific technical processing relating to a person's physical, physiological or behavioural characteristics, which allow or confirm their unique identification, such as facial images or fingerprint data.
Two elements are decisive:
- a simple photograph is not enough: it becomes biometric data when processed with a specific technique, for example to extract a facial template for comparison;
- the purpose is to recognise or verify the person's identity.
Besides face and fingerprints, the category includes iris, voice and hand geometry recognition and, in some cases, behavioural characteristics such as the way someone walks or types.
Article 9 protection
When processed to uniquely identify a person, biometric data falls within the special categories of Article 9 GDPR. Processing it is prohibited except under specific exceptions, including the data subject's explicit consent or necessity for carrying out obligations in the field of employment law, to the extent authorised by law and with appropriate safeguards.
In Italy, Article 2-septies of the Personal Data Protection Code provides that genetic, biometric and health data must be processed in compliance with safeguard measures laid down by the national data protection authority.
Unlocking your phone: why it is different
When you use your fingerprint or face to unlock your smartphone, on most modern devices the biometric template is stored in a protected area of the device and is not sent to the manufacturer. You decide whether to turn the feature on, and the data stays under your control. That is a very different scenario from a system in which your fingerprint is stored in a company's database.
One useful precaution: biometric unlocking is convenient, but always keep a strong passcode as an alternative.
The most common situations
| Situation | Questions to ask |
|---|---|
| Gym access by fingerprint or face | Is there an alternative, such as a card or code? Where is the biometric template stored? |
| Fingerprint clock-in at work | Which law or legal basis allows it? Why is a badge not enough? |
| Online identity check with selfie and document | Who carries out the comparison? How long are the photo and template kept? |
| Facial recognition in shops or events | Are there signs and a privacy notice? Are images compared against lists of people? |
The proportionality principle
A biometric system must be necessary and proportionate to its purpose. To enter a gym or record your arrival time at the office, in most cases less intrusive tools such as a card or code are enough. Where an equally effective alternative exists, the use of biometrics is hard to justify.
Consent must be freely given
If a service asks for your consent to use your fingerprint, the consent is valid only if you can refuse without consequences. A gym offering access by fingerprint or by card respects this principle; one that imposes the fingerprint as the only option does not. In employment, the imbalance between employer and employee makes consent a particularly weak legal basis.
The AI Act
Regulation (EU) 2024/1689 on artificial intelligence, in Article 5, prohibits certain biometric practices considered unacceptable, including building facial recognition databases through untargeted scraping of images from the internet or CCTV footage, and strictly limits the use of real-time remote biometric identification in publicly accessible spaces for law enforcement purposes.
What to ask before providing your biometric data
- Why biometrics are needed and whether there is an alternative.
- Where the template is stored: on a card you hold, on the device or in a central database.
- How long it is kept and how it is deleted when you stop using the service.
- Who can access it and whether it is disclosed to third parties.
- Which security measures protect the data.
The answers should be in the privacy notice; if they are not, you can request them through the right of access under Article 15 and, when you stop using the service, ask for the template to be erased under Article 17.
In short
- Biometric data results from technical processing that allows unique identification, such as facial or fingerprint templates.
- When used to identify a person, it is a special category under Article 9 GDPR; in Italy the safeguard measures of Article 2-septies of the Privacy Code also apply.
- Phone unlocking with a template stored on the device is very different from a central database.
- Biometrics must be necessary and proportionate; where an alternative exists, consent must be refusable without consequences.
- Always ask where and for how long the biometric template is stored.