{"id":17447,"date":"2025-01-15T06:00:50","date_gmt":"2025-01-15T06:00:50","guid":{"rendered":"https:\/\/letslaw.es\/?p=17447"},"modified":"2025-01-08T16:39:31","modified_gmt":"2025-01-08T16:39:31","slug":"biometric-data-processing","status":"publish","type":"post","link":"https:\/\/letslaw.es\/en\/biometric-data-processing\/","title":{"rendered":"Is it biometric data processing if it is not stored? APDCAT’s response"},"content":{"rendered":"

In the field of <\/span>data protection<\/span><\/a>, the <\/span>processing of biometric data<\/span><\/a> has raised many questions, especially in relation to its storage and use. The Catalan Data Protection Authority (APDCAT) has ruled on whether the simple use of biometric data, without storage, constitutes data processing.\u00a0<\/span><\/p>\n

This article explores the APDCAT’s position and its implications for the handling of biometric data in various technological applications.<\/span><\/p>\n

Purpose of biometric data<\/span><\/h2>\n

Biometric data is <\/span>data that is obtained from a person’s unique physical or behavioral characteristics<\/b>, such as fingerprints, facial recognition, iris, voice, or handwriting. These characteristics are inherent to each individual and therefore serve as a highly secure form of identification.<\/span><\/p>\n

The purpose of biometric data processing may vary depending on the context in which it is used, but generally includes:<\/span><\/p>\n

    \n
  1. Authentication and security:<\/b> biometric data is commonly used to verify a person’s identity, providing an additional level of security in access systems, such as in mobile devices, high-security facilities, and access control systems.<\/span><\/li>\n
  2. Identification<\/b>: in some cases, biometric data is used to identify an individual among a group, such as in surveillance systems or government identification databases.<\/span><\/li>\n
  3. Personalization of services:<\/b> some applications use biometric data to personalize services, as in the case of devices that adjust settings based on the identified user.<\/span><\/li>\n
  4. Health and wellness:<\/b> in healthcare, biometric data can be used to monitor vital signs and other health indicators, facilitating medical diagnosis and treatment.<\/span><\/li>\n<\/ol>\n

    It is important to note that the processing of biometric data is subject to strict regulations due to its sensitive nature, and must comply with data protection principles such as minimization, purpose limitation, and informed consent.<\/span><\/p>\n

    Regulations, such as the General Data Protection Regulation (GDPR) in the European Union, establish specific requirements for the processing of biometric data, including obtaining informed consent, limiting the purposes for which the data is used, and ensuring its security.<\/span><\/p>\n

    How is it stored?<\/span><\/h2>\n

    Biometric data storage can be done in several ways, depending on the technology and purpose of the system:<\/span><\/p>\n

      \n
    1. Biometric templates:<\/b> instead of storing the full image of a biometric characteristic (such as a fingerprint), a biometric template is stored. This template is a mathematical dataset that represents the unique characteristics of the biometric, allowing identification without the need to store the full image.<\/span><\/li>\n
    2. Centralized databases:<\/b> biometric data can be stored in centralized databases, where it is collected and managed on a central server. This method is common in government systems or large organizations.<\/span><\/li>\n
    3. Local storage:<\/b> in some devices, such as cell phones or smart cards, biometric data is stored locally on the device. This can improve security by reducing the need to transmit biometric data across networks.<\/span><\/li>\n
    4. Encryption:<\/b> biometric data is often encrypted to protect against unauthorized access. Encryption ensures that the data can only be read by authorized systems that possess the decryption key.<\/span><\/li>\n
    5. Tokenization<\/b>: in some cases, biometric data is converted into a token or code that represents the biometric information. This token is used for authentication without the need to store the original biometric data.<\/span><\/li>\n<\/ol>\n

      Pronouncement of the Catalan Data Protection Authority<\/span><\/h2>\n

      The controversy in the processing of biometric data lies in the <\/span>sensitive nature of this data and the implications for the privacy of individuals<\/b>.<\/span><\/p>\n

      The sanctioned City Council pointed out that \u201cit does not capture, store or reproduce the fingerprints of workers but the assignment of a code that cannot be reproduced by other systems and that, therefore, cannot be qualified as unique identifiers\u201d.<\/span><\/p>\n

      In this sense, the City Council acknowledged that, based on the distinctive characteristics of a person’s fingerprint, it obtains a code that makes it possible to identify him or her when accessing municipal premises.\u00a0<\/span><\/p>\n

      This personal data processing process makes it possible to authenticate a person by means of a biometric analysis. The biometric template acts as a unique identifier, similar to a national identification number, which, although it does not allow to obtain or recreate the fingerprint of an individual, it does allow to identify him\/her univocally.\u00a0<\/span><\/p>\n

      The Catalan Data Protection Authority (APDCAT) has determined that this type of processing, carried out for the purposes of time and attendance control of workers, <\/span>constitutes the processing of special categories of data<\/b>.<\/span><\/p>\n

      Contact Us<\/h2>\n
      \n

      <\/p>

        <\/ul><\/div>\n
        \n
        \n<\/fieldset>\n
        <\/span><\/div>\n
        <\/span><\/div>\n
        <\/span><\/div>\n
        <\/span><\/div>\n