Biometric AI and Special Category Data Under GDPR Article 9

Article 9(1) prohibits the processing of biometric data for the purpose of uniquely identifying a natural person. It is a prohibition with exceptions, not a balancing test, and the most commonly reached-for lawful basis in the whole regulation is not one of the exceptions. That single structural fact ends more biometric AI projects than any technical constraint.

When biometric data becomes special category

Article 4(14) defines biometric data as personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that person. Article 9(1) then lists among the special categories “biometric data for the purpose of uniquely identifying a natural person”. The qualifier is doing real work. A face embedding computed in order to match a person against a gallery is Article 9 data. A model that counts how many people are in a frame without matching anyone is processing personal data, but the purpose test is not met, so Article 9(1) does not engage — Article 6, Article 5 and everything else still do.

The distinction is a purpose test rather than a data-type test, which means it can flip without a single byte changing. A stored embedding generated for liveness detection becomes Article 9 data the moment somebody decides to search the store for a match. This is why the purpose written into your record of processing is not a formality: repurposing an existing biometric feature is the classic route into an Article 9(1) breach without any new collection.

Two locks, not one

Special category processing needs two things at once, and this is the part that is most often got wrong. Article 9(2) does not provide a lawful basis. It lifts a prohibition. You still need a lawful basis under Article 6(1), and separately you need a condition under Article 9(2). Consent is the only word that appears in both lists, which is part of why teams conflate them: Article 6(1)(a) consent and Article 9(2)(a) explicit consent are different standards for different purposes, and satisfying one does not satisfy the other.

Legitimate interests under Article 6(1)(f) is the basis most biometric products would like to rely on, and it is structurally unavailable here — not because a balancing test fails, but because Article 9(2) contains no legitimate-interests gateway at all. There is nothing to balance against. A vendor telling you that a facial recognition feature runs on legitimate interests is either describing processing that is not for identification purposes, or is describing a position that has no Article 9(2) door to walk through. The same reasoning is why an Article 6 legitimate interests assessment, useful as it is for training-data questions, does not answer this one.

The exceptions that can carry it

Article 9(2) has ten sub-paragraphs. For a commercial biometric AI deployment, most are unreachable and the realistic set is small:

• 9(2)(a) explicit consent. The main route for consumer products. “Explicit” means an express statement rather than an inference from conduct, and all the ordinary Article 7 conditions apply: freely given, specific, informed, unambiguous, withdrawable as easily as it was given. The hard part is “freely given”. If the biometric route is the only way to enter a building, clock in at work, or open an account, regulators have repeatedly taken the view that consent is not free and that a non-biometric alternative must genuinely exist and be usable.
• 9(2)(b) employment and social security law. Requires processing necessary for obligations or rights in employment law authorised by Union or Member State law. It is not a general employer permission — it needs a national provision that actually authorises it, which for biometric time-and-attendance in most member states does not exist.
• 9(2)(e) manifestly made public by the data subject. The provision reached for by anyone scraping faces from the open web. The Court of Justice read it narrowly in Case C-252/21, Meta Platforms v Bundeskartellamt, judgment of 4 July 2023, holding that it requires the data subject to have manifestly made the data public themselves, with the intention of doing so — see the Court’s docket for C-252/21. A photograph posted by a third party, or posted by the subject without any intention that their face be used as a biometric identifier, is not within it on that reading.
• 9(2)(g) substantial public interest. Available only on the basis of Union or Member State law which is proportionate, respects the essence of the right and provides suitable safeguards. This is the route most law-enforcement and border deployments travel, and it is not a route a private product can take on its own.
• 9(2)(f) legal claims and 9(2)(c) vital interests exist and are occasionally correct, but neither supports ongoing product processing — they are narrow, situational and time-limited by their own terms.

Two further conditions apply on top of any of these. Article 9(2)(a) consent can itself be disapplied by Union or Member State law, which means a member state can decide that consent is not enough for a given biometric use. And Article 35(3)(b) makes a DPIA mandatory for processing on a large scale of special categories of data — so a compliant biometric deployment has a DPIA before it starts, not after.

Article 9(4) and the national layer

Article 9(4) permits member states to maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health. This is the provision that makes “is biometric authentication allowed in Europe?” a question with twenty-seven answers rather than one. Some states have used it to permit narrow authentication and security uses; others have added consultation or authorisation requirements; some have said nothing, leaving the bare Article 9 position. There is no authoritative consolidated table of these provisions maintained by the Commission, and the only reliable source for your own position is the national implementing act itself.

Where the AI Act sits on top

The GDPR analysis is necessary and not sufficient. Regulation (EU) 2024/1689, the AI Act, adds prohibitions and high-risk classifications that bite on exactly this ground and are independent of whether you have an Article 9(2) condition. Article 5 prohibits, among other things, biometric categorisation systems that infer sensitive attributes, and emotion inference in the workplace and in education, each with carve-outs that are narrower than they first appear. Annex III classifies remote biometric identification, biometric categorisation and emotion recognition as high-risk where they are not prohibited outright. Those rules are set out in EUR-Lex, Regulation (EU) 2024/1689.

The relationship between the two instruments is additive, not alternative: an Article 9(2)(a) explicit consent does not make a prohibited practice lawful, and AI Act conformity does not supply a GDPR condition. Recital 10 of the AI Act says as much — it leaves Union data protection law unaffected. For the AI Act side of the same deployment, see the Annex III biometrics classification and the emotion recognition prohibition. Outside the EU, the closest analogue with real enforcement history is Illinois — see BIPA and facial recognition AI — and its consent-and-written-policy structure is different enough that compliance with one says little about the other.