Article 10

(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 4;,;and without prejudice to the prohibited practices outlined in Article 5, the rules for classifying high-risk AI systems laid down in Article 6, the obligations imposed on operators of high-risk AI systems in Article 26 and the transparency obligations imposed in Article 50 of this Regulation.

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), using a one-to-one comparison carried out locally on the data subject’s device, where the biometric data or the means needed for the verification is under the sole control of the data subject. This point shall only apply to verification and shall not cover the identification of a natural person using a comparison between his or her biometric data and the biometric data stored in a database within the meaning of Regulation (EU) 2024/1689; it shall not affect the prohibition provided for in Article 5(1), point (e), of this Regulation.;

4. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data, such as pseudonymisation, data minimisation and filtering at the point of collection, at-source filtering of training data, access restrictions as well as state-of-the-art privacy-preserving and privacy-strengthening methods. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data without undue delay. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties. In order to determine whether the deletion of the data involves disproportionate effort, consideration shall be given to the state of the art, the implementation costs, the volume of data in question, the technical feasibility of isolating or extracting the data as well as the nature, scope and purposes of processing.