{"answer_id":"praxikon:eu:gdpr:answer:biometrie-gezichtsdatabase","canonical_page":"https://www.praxikon.com/en/antwoord/avg/biometrie-gezichtsdatabase","query":"May an organisation process biometric data or a database of facial features?","lang":"en","view":"full","mode":"gdpr","regime":"gdpr","topic":"biometrie-gezichtsdatabase","question":"May an organisation process biometric data or a database of facial features?","label":"Biometric data and facial databases","answer":"As a rule, no. Facial features processed to uniquely identify a person are biometric data (Article 4(14)) and fall under the prohibition on processing special categories of personal data (Article 9(1)). That prohibition applies unless an exception in Article 9(2) applies, such as explicit consent; a legal basis under Article 6 is needed as well. The Dutch Data Protection Authority fined Clearview AI a total of EUR 30.5 million in 2024 for a database of facial images scraped from the internet. Separately, since 2 February 2025 the AI Act prohibits AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage (Article 5(1)(e) AI Act).","applied_to_question":null,"matched_terms":[],"articles":[{"article":4,"source_locator":"Art. 4(14) GDPR","point":"Definition of biometric data.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/4"},{"article":9,"source_locator":"Art. 9(1) GDPR","point":"Prohibition on processing special categories of personal data, including biometric data for unique identification.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/9"},{"article":9,"source_locator":"Art. 9(2) GDPR","point":"The exceptions to the prohibition.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/9"},{"article":null,"source_locator":"Art. 5(1)(e) AI Act","point":"Prohibition on creating facial databases through untargeted scraping (since 2 February 2025).","source_title":"AI Act (Regulation (EU) 2024/1689)","source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","human_page":null}],"case_law":[],"guidance":[],"enforcement":[{"id":"gdpr-enforcement-clearview-30-5m-gezichtsherkenning","kind":"enforcement","title":"Clearview AI: 30.5 million euro fine and penalty orders for illegal facial database","issuer":"Autoriteit Persoonsgegevens","reference":"Besluit tot opleggen boetes en lasten onder dwangsom Clearview AI Inc., AP, 16 mei 2024 (kenmerk niet gepubliceerd; bekendgemaakt 3 september 2024)","ecli":null,"date":"2024-05-16","status":"final","point":"Fines of EUR 20 million and EUR 10.5 million for a scraped facial database (Art. 6, 9(1), 12 and 14).","source_url":"https://www.autoriteitpersoonsgegevens.nl/documenten/besluit-boete-clearview-ai","human_page":"https://www.praxikon.com/en/avg/handhaving/clearview-30-5m-gezichtsherkenning"}],"open_questions":["On which exception of Article 9(2) does the organisation rely?"],"human_page":"https://www.praxikon.com/en/avg/artikel/4","dataset":{"id":"praxikon-gdpr","source":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","known_at":"2026-09-15"},"casus_check":"https://www.praxikon.com/en/casus-check","disclaimer":"General interpretation, not legal advice. The official source remains authoritative.","methodology":"https://www.praxikon.com/en/methodologie"}