Compliance with European Data Protection Law and Regulation

An airport operator wants to let passengers pass through boarding gates using live facial recognition matched against a template created at check-in. Legal asks whether the GDPR treats the facial templates as a special category of data and, if so, what that means for the lawful basis. Which statement best reflects the GDPR position on this processing?

• AThe templates are ordinary personal data because a photograph only becomes special category data once it is published, so Article 6 alone governs the boarding gates.
• BBecause boarding is a contractual necessity, Article 9 is automatically satisfied and no separate special category condition needs to be identified.
• CFacial recognition for access control falls under the general prohibition on automated decision-making, so the only requirement is offering passengers human review of any non-match.
• DThe templates are biometric data processed for unique identification and therefore special category data, so an Article 9 exception, typically explicit consent, must apply on top of an Article 6 basis.check_circle Correct

Why A is wrong: This conflates a plain photograph with biometric processing; publication is irrelevant, and once the image is processed through specific technical means for unique identification it becomes biometric special category data, so Article 6 alone is insufficient.

Why B is wrong: Contractual necessity is an Article 6 basis only; Article 9 contains its own exhaustive list of conditions, and necessity for a contract is not among them, so a separate Article 9 condition is still required.

Why C is wrong: Automated decision rights may be engaged, but they do not displace the Article 9 special category analysis; the question of whether a valid exception authorises the biometric processing remains, so this answer misidentifies the core issue.

Why D is correct: Biometric data processed for the purpose of uniquely identifying a person is special category data under Article 9(1), so the controller needs an Article 9 condition such as explicit consent in addition to an Article 6 lawful basis.