The Information Commissioner’s Office (ICO) has recently published draft guidance on biometric data for public consultation. The consultation will run until 20 October 2023.

Examples of biometric technologies include facial recognition, iris scanning and voice recognition. Biometric data is increasingly being used in a variety of industries from banking to life sciences, often to securely identify the user, but other organisations including the police are looking to utilise technologies such as facial recognition for the purposes of crime prevention. Other possible everyday uses of biometric data could include targeted advertising to devices when an individual visits a particular town, area or shop.

There have been calls for some time for greater clarity in this area, particularly due to the perceived risks posed by this type of data processing. These risks include systems which could have a discriminatory impact on people, together with the security risks of a security breach involving biometric data. Automated processing and the rapidly evolving use of artificial intelligence and machine learning are likely to increase the risks posed by this type of processing. Because of these perceived risks, data protection laws categorise biometric data as "special category personal data" meaning that additional requirements apply when organisations wish to process this type of personal data.

The draft guidance includes some important clarifications, including:

• It is highly likely that a data privacy impact assessment (DPIA) will be required before any processing of biometric data.
• In most cases, explicit consent of the data subject is likely to be the only valid condition for processing biometric data.
• If explicit consent cannot be obtained and no other condition is appropriate, processing of biometric personal data will be unlawful.