EU—Article 29 Working Party publishes biometrics opinions

On March 22 and April 27, the Article 29 Working Party published two opinions on biometrics, one relating to facial recognition in online and mobile services (Opinion on Facial Recognition) and a second on developments in biometric technology (Opinion on Biometrics). Both opinions build on the Working Party’s Working Document on Biometrics and seek to provide greater guidance to authorities, the biometrics industry and users alike.

The Opinion on Biometrics, which deals with the broader category of biometric technology—interestingly, published after the Opinion on Facial Recognition—sets out the basis legal framework for the implementation of biometric technology. It focuses on the clarity of purposes—and notice—for processing biometric data, the protection of fundamental rights of the data subject and ensuring that alternative means are available for data subject to choose should they not wish to have their biometric data processed. This is particularly emphasized in tandem with consent as a legal basis for processing; less privacy-intrusive mechanisms should be made available to permit individuals to have real choice to consent to biometric processing. The Working Party highlights this, specifically, within the context of employment, where freely given consent is often questioned.

The Opinion on Facial Recognition discusses the instances when digital images qualify as personal and sensitive data as well as the legitimate grounds for processing this personal data. One point which is highlighted is that consent from the image uploader should not be confused with the necessity of legitimate grounds for processing other individuals who may also be in the image. Here, a data controller will likely need to rely on its legitimate interests and sufficient balance these against the fundamental rights and freedoms of the data subjects.

Both opinions present detailed definitions relating to biometric technology and practical examples of how biometric personal data should—and should not—be utilized in practice. In light of the rapidly evolving technology and use of biometrics, these opinions set the framework on how to implement biometrics and what steps should be taken to properly protect the processing of personal data within such processing. This will provide companies and business, including online and mobile device companies, with detailed guidance on the use of biometrics in the European Union.