GDPR Article 9 and BDSG Section 26(3), Special Categories and Employment Biometric Data in Germany

Regulation (EU) 2016/679, Art. 9; Bundesdatenschutzgesetz (BDSG) §26(3)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 25 May 2018.

A sensitive categories rule binding private bodies.

As of 24 August 2026.

What it requires

Where you deploy a biometric time clock, access control system, or voice-authentication system for employees in Germany, satisfy BDSG Section 26(3)'s conditions rather than relying on employee consent as the sole basis.
Treat any biometric identifier your system derives through its own technical processing as General Data Protection Regulation (GDPR) Article 9 special category data, whether or not the source photo or audio was publicly available.

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

General Data Protection Regulation (GDPR) Article 9(1) governs biometric data as a special category. BDSG Section 26(3), the provision governing special category data in employment, was upheld as GDPR-compatible and is the controlling provision for a workplace-deployed biometric time clock, access control, or voice-authentication system; Section 26(1), the general employment lawful-basis clause, was found incompatible with GDPR's own conditions and cannot be relied on alone.

Consent is disfavored as the legal basis in an employment relationship because of the power imbalance, so employers typically rely on necessity under Section 26(3) or Article 9(2) rather than Article 9(2)(a) consent. A voiceprint or faceprint captured for identification is covered identically to a fingerprint; GDPR draws no distinction by modality.

Germany's leading biometric enforcement precedent is the Hamburg Commissioner for Data Protection and Freedom of Information's 2021 order against Clearview AI to delete a German complainant's biometric identifier, the first such order against Clearview worldwide.

When LexLint raises it

processes_biometrics
processes_voice
high_risk_decisions

Read the law

Official Journal text, EUR-Lex, Regulation (EU) 2016/679
BDSG §26(3); Hamburg Commissioner Clearview AI order (2021)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app