Article 9 – Processing of special categories of personal data

incidental and residual processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model as referred to in Regulation (EU) 2024/1689, subject to the conditions referred to in paragraph 5.

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the one-to-one verification is under the sole control of the data subject and, where applicable, subject to appropriate safeguards to protect the fundamental rights and the interests of the data subject, as laid down in Union law or Member State law, in accordance with paragraph 4 of this Article.

For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data that are incidentally and residually involved in the datasets used for training, testing or validation or in the AI system, the controller shall erase such data. If erase of those data proves to be impossible or requires manifestly disproportionate effort, the controller shall, without undue delay and in any event, effectively protect such data from being further processed or processed for other purposes, used to produce outputs, disclosed or otherwise made available to third parties. The controller shall establish a process of regular verification and assessment of the effectiveness of the measures implemented and shall comprehensively document those measures and the results of the assessments throughout the life cycle of the AI system.