Data Protection and Biometric Law

Long before the AI Act, video of identifiable people was personal data. That has not changed and it is the layer most deployments actually trip over.

General orientation, not legal advice; requirements vary by jurisdiction.

The baseline

Video showing identifiable people is personal data.

Automated analysis of it is processing, requiring a lawful basis, purpose limitation, minimisation, accuracy, storage limitation and security.

Biometric data used to uniquely identify someone is a special category, requiring a further condition beyond the ordinary basis.

A template is biometric data from the moment it is computed, whether or not any image is stored. Products claiming to be privacy-preserving because they discard frames have not necessarily avoided this.

Lawful basis in practice

Legitimate interests is the common basis for security and safety monitoring, and it requires a documented balancing test against the rights of the people affected.

Consent is a weak basis in employment, because it cannot be freely refused where there is a power imbalance.

Consent in public-facing contexts is difficult for a different reason: someone walking into an area cannot meaningfully consent to being analysed before they arrive.

Legal obligation covers some safety and sectoral cases.

For special-category biometric data an additional condition is needed, and the available conditions are narrow. In several jurisdictions explicit consent is effectively the only route for private-sector identification, which returns to the employment problem.

Impact assessments

Required before systematic monitoring of publicly accessible areas and before large-scale processing of special-category data in several regimes.

Contents that matter: what is processed, why, the necessity and proportionality reasoning, the risks to people, and the safeguards.

The proportionality reasoning is the part regulators examine, and it must show that less intrusive alternatives were considered. Aggregate counting is almost always one of them.

Record it at the time. Reconstructed reasoning is worth very little.

The rights that follow

Access. People can ask what is held about them, which for a video system means being able to find and produce it.

Erasure and objection, in defined circumstances.

Information about automated decisions with significant effects, and human involvement in them.

Design for these. A system that cannot answer a subject access request within the statutory period is a problem you have already created.

Biometric statutes in the United States

Several states have biometric privacy statutes imposing notice and consent requirements before collecting biometric identifiers, with retention and destruction schedules.

Some provide a private right of action, which has produced substantial litigation and settlements.

Several cities have restricted government use of facial recognition specifically.

There is no single federal regime, which means the analysis is per state and per use.

The practical checklist

Can you name the lawful basis?

If biometric, can you name the additional condition?

Has the assessment been done and recorded?

Is the notice specific about what is analysed?

Is retention defined and enforced by deletion rather than by policy?

Can you answer an access request?

Have you documented why a less intrusive design was rejected?

A deployment that cannot answer all seven is not ready, whatever the technical readiness.

The template question

The single question that determines which regime applies, and it is frequently answered wrongly.

Is a biometric template computed at any point, for the purpose of telling one person from another?

If yes, biometric data exists — regardless of whether images are stored, whether it is called a hash, or whether it is deleted immediately.

Ask the vendor directly, in writing.

"We do not store images" is not an answer to this question, and it is the answer most commonly given.

A product that cannot answer it clearly should be assumed to compute one.

Answering an access request

It will arrive, and the system either supports it or does not.

Know where a person might appear: which cameras, which retention, which detection records.

Know how to search without trawling footage of everyone else.

Know what redaction is needed for other people in frame.

Know the statutory response period and whether you can meet it.

Test it once, on a volunteer, before it is needed — which is also the fastest way to discover that your retention is longer than you thought.