Biometric data guidance: Biometric recognition

About this guidance

• • Why have you produced this guidance?
  • Who is it for?
  • What does it cover?
  • What doesn’t it cover?
  • How should we use this guidance?

Key data protection concepts

• • What is personal information?
  • What is biometric data?
  • What is special category biometric data?
  • What about other special category information?
  • Are we processing personal information if we delete it quickly?

Biometric recognition

• • What do you mean by "biometric recognition"?
  • How do biometric recognition systems work?
    • Biometric capture, feature extraction and template creation
    • Comparison
    • Decision-making and thresholds
  • What can we use biometric recognition systems for?
  • Do biometric recognition systems use personal information?
  • Do biometric recognition systems use biometric data?
    • The personal information is about someone’s physical, physiological or behavioural characteristics
    • The personal information results from specific technical processing
    • The personal information allows or confirms someone’s unique identification
  • Do biometric recognition systems use special category biometric data?

How do we demonstrate our compliance with our data protection obligations?

• • Who is the controller for our biometric recognition system?
  • Data protection by design and default
  • Do we need to do a DPIA?
  • What risks to rights and freedoms should we consider?
    
    • Risks resulting from personal data breaches
    • Risks resulting from biometric false acceptance or rejection
    • Risk of discrimination
    • Risks resulting from systematic monitoring of public spaces

How do we process biometric data lawfully?

• • How do we determine our lawful basis and special category condition?
  • Can we use consent and explicit consent?
  • What other lawful bases might apply?
  • What other special category conditions might apply?
    • Substantial public interest
    • Research
  • What if we don’t have explicit consent and no other condition applies?

How do we process biometric data fairly?

• • How does the statistical accuracy of biometric algorithms relate to the fairness principle?  
    • How do we deal with risks resulting from errors?
  • How do we deal with the risk of discrimination?

How does the accuracy principle apply to biometric data?

• • Does the accuracy principle apply to our biometric recognition system?
  • When do we need to collect new biometric samples?

How do we ensure our processing of biometric data is transparent?

• • What information do we have to share to comply with the transparency people?
  • How should we provide transparency information?

How do we consider rights requests for biometric data?

• • What is the right of access?
  • What is the right to rectification?
  • What is the right to erasure?
  • What is the right to data portability?
  • What is the right to object?
  • Can we use a biometric recognition system to make automated decisions about someone?

How do we keep biometric data secure?

• • What are appropriate security measures?
  • Can PETs help us comply with our data protection obligations?
    • Biometric template protection
    • Personal information in biometric samples and templates
    • On-device verification
  • How can we comply with the data minimisation and storage limitation principles?
  • Should we retain biometric samples?