biometric data
In plain wordsInformation about your body or behavior — your face, fingerprints, voice, eyes or the way you walk — measured by technology and used to recognize who you are or to guess things about you.
Measurements of a person's body or behavior — facial geometry, fingerprints, iris patterns, voiceprints, gait, typing rhythm — captured by sensors and usually reduced to a numerical template or embeddingembedding, n.: A list of numbers that stands for a word, picture or other item, arranged so that similar items get similar lists. It lets a computer measure similarity of meaning as distance. that can be compared with others; in law, a category of personal data. Biometric systems perform verification (one-to-one: is this the claimed person?), identification (one-to-many: who is this?), or categorization and inference of attributes such as age or emotion. Because biometric traits cannot be changed if leaked and allow people to be tracked without their knowledge, the law treats them as especially sensitive. The GDPRGeneral Data Protection Regulation, prop. n.: The European Union's main privacy law, in force since 2018, which controls how personal information is collected and used — including to train and run AI systems. counts such measurements as biometric data only when they allow or confirm a person's unique identification, and restricts processing them for identification as a special category; the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models. adopts a broader definition without that condition, underpinning its rules on remote biometric identificationremote biometric identification, n.: Using AI to recognize people at a distance — usually by matching faces in camera footage against a database — without their taking part. The EU strictly limits live police use of it in public places., biometric categorisationbiometric categorisation, n.: Using AI to sort people into groups — by age, sex, ethnicity and the like — from their faces, voices or other body features. The EU bans using it to guess sensitive traits such as religion or sexuality. and emotion recognitionemotion recognition system, n.: AI that tries to work out how people feel or what they intend from their faces, voices or bodies. The EU bans it at work and in schools and tightly regulates it elsewhere.. Illinois's Biometric Information Privacy Act (2008) requires written consent and lets individuals sue.
The system never stores face images, only encrypted biometric templates that cannot be turned back into a photo.
Origin
Measuring bodies for identification dates to Alphonse Bertillon's anthropometric system for the Paris police (1879) and the fingerprint classifications of Francis Galton and Edward Henry in the 1890s. 'Biometric data' became a defined legal category in Illinois's Biometric Information Privacy Act (2008) and the EU's GDPR (2016), and was extended by the EU AI Act (2024).
Usage note
A photograph is not automatically biometric data under the GDPR; it becomes so when processed with specific technical means to identify someone. Under the AI Act, verification that only confirms a claimed identity, such as unlocking a phone, is treated far more leniently than identifying people in a crowd.
Related
- facial recognitionfacial recognition, n.: Technology that identifies or checks who someone is by comparing a picture of their face with stored photos, used by phones, passport gates and police databases.
- remote biometric identificationremote biometric identification, n.: Using AI to recognize people at a distance — usually by matching faces in camera footage against a database — without their taking part. The EU strictly limits live police use of it in public places.
- biometric categorisationbiometric categorisation, n.: Using AI to sort people into groups — by age, sex, ethnicity and the like — from their faces, voices or other body features. The EU bans using it to guess sensitive traits such as religion or sexuality.
- emotion recognition systememotion recognition system, n.: AI that tries to work out how people feel or what they intend from their faces, voices or bodies. The EU bans it at work and in schools and tightly regulates it elsewhere.
- speaker verificationspeaker verification, n.: Checking whether a voice really belongs to the person it claims to be, as when a bank confirms your identity by the sound of your voice on the phone.
- data protectiondata protection, n.: Laws and practices that control how organizations collect, use, store and share information about people, and that give people rights over it, such as seeing it or having it deleted.
- privacyprivacy, n.: Your ability to control who knows what about you. AI raises new privacy questions because it learns from huge amounts of personal data and can infer things about people they never shared.
Defined in law or standards
GDPR (Reg. (EU) 2016/679), Art. 4(14) and Art. 9; EU AI Act (Reg. (EU) 2024/1689), Art. 3(34); Illinois Biometric Information Privacy Act, 740 ILCS 14/10
Mentioned in
affective computingaffective computing, n.: Technology that tries to read people's emotions — from their faces, voices or words — or to display emotions of its own, like software that guesses your mood or a robot that seems to show feelings., data protectiondata protection, n.: Laws and practices that control how organizations collect, use, store and share information about people, and that give people rights over it, such as seeing it or having it deleted.