Mr. Cathal Ryan:

Article 9 of the GDPR sets out conditions for processing of special category data. Biometric data is included within that. Under Article 9, it is considered a derogation. Effectively, in order to process sensitive data, one needs to rely on one of the derogations set out in Article 9(2). One will see what measures need to be implemented, such as explicit consent or whether it is in the public interest, which is distinguished to be "for reasons of substantial public interest". The processing of biometric data and, in particular, facial recognition software involves the area covered by Article 9 and one will need to satisfy a condition under Article 9 to proceed. I have not carried out any assessment of the case of which the Deputy may be aware, although I think he is raising it more as a general issue.

Much of this issue comes down to the kind of processing that is taking place. For example, processing sometimes takes place in an airport in a situation where there is no attempt to attach any personal information but, rather, to measure a queue. Is there processing of personal data in measuring a queue of individuals coming into an airport and leaving through the security gates? There are different types of processing taking place. There is an important distinction between matching facial data to other data and just looking at individuals moving through an airport queue but not trying to match that data with anything else. Much of the issue comes down to the processing itself, the nature of the processing and whether there is matching of data with other personal data such as the person's name and so on.