Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, whether (a) recorded voice and (b) creative output is considered biometric data for the purposes of regulation.

All organisations in the UK that process personal data, including biometric data, have to comply with the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA).

The UK GDPR defines biometric data as ‘personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data’. This includes voice recognition, alongside other techniques.

All biometric data is personal data, as it relates to an identified or identifiable individual. Biometric data is also special category data whenever you process it “for the purpose of uniquely identifying a natural person”. This means that biometric data will be Special Category Data in many cases.

If an organisation considers that it is processing biometric data, but not for the purposes of uniquely identifying a natural living person, then they should clearly document their rationale alongside a risk based analysis of the use. In any event, the data should be handled in line with the data protection principles.

The ICO has published guidance for organisations on the processing of special category and biometric data, which can be found here.