Biometrics and restrictive data minimisation

Biometrics & Digital Omnibus: EU Council’s draft compromise could cripple biometrics in *all* industries if unchanged.

The use of biometrics for identity verification is often based on consent (Art. 9(2)(a) GDPR), and the Commission’s proposal added a consent exemption if “the biometric data or the means needed for the [identity] verification is under the sole control of the data subject”.
So no consent needed in case of biometric identity verification on a secure, on-device part of your smartphone – otherwise, consent rules.

The EU Council’s draft additions to the Recitals, however, could make even reliance on consent much harder.

As the adapted Recital 34 of the GDPR Digital Omnibus would now read:
Where biometric data are processed for the purpose of confirming the identity of a data subject, controllers should, where possible, prioritise authentication methods that do not involve the processing of biometric data. The controller should choose from equally effective means the less intrusive one. The processing of biometric data for identity verification should therefore only be used where necessary and proportionate and subject to appropriate safeguards.

This is suspiciously similar to the ideas developed in the EDPB’s Art. 64 GDPR Opinion on facial recognition in airports, Opinion 11/2024. (So was it drafted by the EDPB or one of its members such as the EDPS?)

That Opinion went largely unnoticed, but I have been fairly critical of it.

One of the ideas it included was that as regards the measures chosen to streamline passenger flow in airports, “in order to comply with the requirement of data minimisation” and thus “the necessity principle”, the controller had to be able to demonstrate that “there are no less intrusive alternative solutions that could achieve the same objective as effectively.
On the face of it, this seems to make sense. With any processing, you should assess whether alternatives exist.

The problem is that the EDPB then used that to *REJECT* various biometric identity verification methods *EVEN* when a choice was being offered to passengers between two methods. So if passengers had a clear choice between manual and biometric identity verification, *the latter was prohibited* for incompatibility with data minimisation.
[See §15(4), 31, 76 & 89]

Fast-forward to the Council’s proposal, and what does it mean? In *ALL* industries, authorities could *BAN* the use of biometrics based on data minimisation if a less intrusive alternative exists. Your face or fingerprint unlocking of your phone? Banned (if considered as processing by the controller), because the PIN approach still exists. Biometrics as an optional replacement for badges? Nope.

Yet necessity / data minimisation must be *assessed differently* if alternatives are offered. Some will choose the more convenient biometric alternative, others the “non-biometric” one.
With a valid choice under data protection law, a biometric option must remain possible.