Skip to main content
Praxikon

Legislation in motion

Proposal: exception for biometric verification under the data subject's sole control (Article 9(2)(l) GDPR)

Date
Status
proposal
Body
Europese Commissie
Reference
COM(2025) 837 final, artikel 3, punt 3, onder a (nieuw artikel 9, lid 2, onder l AVG), overweging 34; 2025/0360(COD); ST 15698/25

What it is about

The proposal adds an exception to the ban on processing biometric data. Processing is allowed where it is necessary to confirm a data subject's identity (verification, a one-to-one comparison) and the biometric data or the means needed for verification are under the sole control of the data subject. According to recital 34 this is the case, for example, where the data are stored only on the data subject's side, or stored by the controller in state-of-the-art encrypted form with the key held solely by the data subject. Identification (a one-to-many search in a database) is not covered. In Joint Opinion 2/2026 the EDPB and EDPS welcome the exception, but ask to add necessity and proportionality to the recital, to delete the statement that such processing is not likely to create significant risks, and to include examples of appropriate safeguards.

What this means in practice

If adopted, you could offer biometric verification (such as fingerprint or face login) without relying on explicit consent as the Article 9 exception, provided the data subject has sole control: storage on the person's own device, badge or smart card, or encrypted storage where only the data subject holds the key. Storing biometric data centrally in the clear or with a key you control would not be covered. You would still need a legal basis under Article 6, must check whether a less intrusive method suffices, and must carry out a risk assessment.

The GDPR articles concerned

Source: Raad van de EU, register (COM(2025) 837 final als ST 15698/25); EDPB-EDPS Joint Opinion 2/2026checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

Case law8 of 10

Guidelines8 of 10

Enforcement and fines8 of 9

Legislation in motion6 of 17