Certified Information Privacy Professional – Europe (CIPP/E) — Question 63

Many businesses print their employees’ photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GDPR. Why would such practice be permitted?

Answer options

• A. Because use of biometric data to confirm the unique identification of data subjects benefits from an exemption.
• B. Because photographs qualify as biometric data only when they undergo a “specific technical processing”.
• C. Because employees are deemed to have given their explicit consent when they agree to be photographed by their employer.
• D. Because photographic ID is a physical security measure which is “necessary for reasons of substantial public interest”.

Correct answer: B

Explanation

Option B is correct because photographs are classified as biometric data only if they undergo specific technical processing, which is not the case for standard employee ID photos. The other options suggest exemptions or consent that do not align with the GDPR's definition of biometric data, making them incorrect in this context.