Law note · United Kingdom
UK GDPR Article 9, Special Categories of Personal Data Including Biometric Data
Biometric data used for identification, fingerprints, facial templates, voiceprints, is special category data under UK General Data Protection Regulation (GDPR) Article 9, the same definition as EU GDPR.
The DPA 2018's Schedule 1 supplies the UK's own list of Article 9(2)(g) substantial public interest conditions, 23 conditions in Part 2 of Schedule 1, in addition to explicit consent, employment and social-security processing authorised by law, vital interests, not-for-profit bodies, data manifestly made public, legal claims, health and social care, public health, and archiving and research.
The ICO's own "Biometric recognition" guidance, published in final form 5 March 2024, states that biometric data becomes special category personal data from the moment of collection once a purpose of unique identification has been determined for it, and that explicit consent is likely to be the legal basis most organisations need for biometric recognition specifically.
The Data (Use and Access) Act 2025 inserted a new Article 11A UK GDPR giving the Secretary of State a ministerial power to expand what falls within Article 9's restricted scope, covering genetic data, biometric data for unique identification, and health data, by regulation; no such regulation had been made as of this research.
The ICO fined Clearview AI Inc GBP 7,552,800 for, among other findings, failing to meet the higher data protection standard biometric data requires; the Upper Tribunal restored that finding in October 2025 after the First-tier Tribunal had overturned it on jurisdictional grounds.
What it asks of an app
- Obtain explicit consent, or establish another UK General Data Protection Regulation (GDPR) Article 9(2) or Data Protection Act 2018 Schedule 1 basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
- Treat biometric data as covered from the moment you collect it once you have determined a purpose of unique identification, not only from the point you actually perform identification or verification, per the ICO's Biometric recognition guidance.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, high_risk_decisions
Primary source: legislation.gov.uk, official consolidated text
ICO Biometric recognition guidance (5 March 2024); ICO v Clearview AI Inc, Upper Tribunal (October 2025)