Biometric data
Biometric data means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that person, such as facial images or fingerprint data (Art. 4(14) GDPR).
Two conditions must be met: the data must derive from a technical process (a raw photograph is not biometric data; a facial template extracted from it is), and it must be capable of uniquely identifying the individual. When biometric data is processed for the purpose of uniquely identifying a person, it becomes a special category of personal data under Art. 9 and requires an exemption such as explicit consent or a substantial public interest basis.
In life sciences, biometric processing is increasingly common: voice biomarkers, gait analysis from wearables, retinal and facial imaging, and biometric authentication for eConsent or site access. Where the purpose is clinical measurement rather than identification, the data may not fall under Art. 9 as biometric data, but it will usually qualify as data concerning health. Biometric identification systems are also regulated as high-risk or prohibited practices under the EU AI Act.
