Article 9 – Processing of special categories of personal data

incidental processing of residual data, where not intended by the controller, in the context of the development and technical operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model as referred to in Regulation (EU) 2024/1689, subject to the conditions referred to in paragraph 5.

processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the one-to-one verification is under the sole control of the data subject and, where applicable, subject to appropriate safeguards to protect the fundamental rights and the interests of the data subject as laid down in Union law or Member State law, in accordance with paragraph 4 of this Article.’

For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data that are incidentally and residually involved in the datasets used for the development of and technical operation of the AI system or AI model, including training, validation and testing, the controller shall erase such data without undue delay. If erasure of those data proves to be technically impossible or requires manifestly disproportionate effort, the controller shall, without undue delay and in any event, effectively protect such data from being further processed or processed for other purposes, used to produce outputs, disclosed or otherwise made available to third parties.