The GDPR or General Data Protection Regulation aims to protect personal data in all European Union member countries, being a mandatory regulation in all of them. Biometric data for the GDPR is of great relevance as it allows for precise identification of individuals through sensitive information.
For example, when installing access control for security in a company or industry, it is important to consider what biometric data will be managed to ensure compliance with the requirements set by this European data protection regulation and thus avoid possible sanctions or fines.
What GDPR understands by biometric data
The GDPR defines biometric data as any personal information related to the physical, physiological, or behavioral characteristics of a person, allowing or ensuring their unique identification. This identification is achieved through elements such as fingerprints, iris patterns, facial recognition, and even behavioral aspects such as typing dynamics and walking gait.
The GDPR places biometric data within the special categories of personal data under Article 9, which implies significant restrictions on its processing (processing of this data is prohibited except under exceptional circumstances since they reveal personal and distinguishing information that allows for the unequivocal identification of individuals).
What constitutes biometric data
Biometric data comprises a wide range of unique and measurable characteristics of individuals that allow for their precise identification. Among the most common are fingerprints, facial and iris recognition, which are widely used in security and access control systems.
Other methods include hand and retina geometry recognition, as well as vascular recognition, which is based on the unique patterns of blood vessels.
In addition to methods based on physical characteristics, there are other types of biometric data that use behavioral aspects for identification.
- Signature and handwriting recognition, which analyze unique patterns in the way a person writes.
- Voice recognition, which uses unique vocal characteristics.
- Keystroke dynamics and gait recognition, which identify individuals by their behavior when performing these activities.
- More detailed aspects such as DNA, skin texture, and ear shape can be classified as biometric data due to their ability to uniquely distinguish individuals.
What is biometric identification and authentication
Both European regulations and Spanish data protection regulations consider the processing of biometric data as high risk, in relation to identification and verification processes.
- Biometric identification involves recognizing an individual within a group by comparing the person’s information to that of all members of the group (one-to-many comparison).
- Biometric authentication or verification focuses on confirming the identity of a subject by directly comparing the individual’s biometric data to data previously stored and linked to that specific identity (one-to-one comparison).
How biometric data is handled
When implementing a biometric access control or person identification system, it is necessary to conduct a prior impact assessment to verify if there is another less intrusive system.
Biometric data under the GDPR must be treated as high risk, as mentioned earlier, taking into account a number of crucial aspects.
Requirements for processing
The processing of biometric data must be identified as suitable and necessary, implemented proportionally (specifically applied to address a need).
To process data with biometric systems, measures such as the following must be taken:
Inform individuals about biometric processes and the significant risks they entail. Implement encryption techniques and technologies to protect the biometric templates used. Include mechanisms to unlink a person’s identity from their biometric template. These templates can only be used for the purposes originally stipulated. Prevent the connection between different biometric databases and the disclosure of the information contained in them. Apply the minimization policy in the collection of biometric data. In work environments (attendance records or access control), guarantees regarding these treatments must be clearly specified in collective agreements. They must be deleted when they are no longer necessary for the purposes for which they were collected.
Penalties
Non-compliance with the GDPR regarding the processing of biometric data can lead to significant penalties, as this data is considered special and therefore enjoys additional protection.
Penalties vary depending on the severity and nature of the breach, ranging up to €20 million or up to 4% of the global annual turnover of the previous financial year (whichever is higher).
Biometric data for GDPR must be treated specifically to ensure maximum protection of this special or sensitive information. Trusting security professionals is the best alternative to ensure compliance with this regulation in a company or industry.
At Microsegur, we are experts in advanced security installations and have extensive experience helping companies and industries elevate their level of protection. Do not hesitate to contact us for personalized attention to the needs and particular characteristics of your business.
