EU considers new rules on facial recognition

However, there is a discussion on whether new rules are necessary, as the legal framework might already be there under the bloc's General Data Protection Regulation (GDPR). The GDPR was adopted on April 2016 and took effect in May 2018. Facial recognition data is considered "biometric data", which is a special category of personal data resulting from the technical processing of physical, physiological, or behavioural characteristics. According to GDPR, the processing of "biometric data" to identify a person requires explicit consent from the person whose data is being collected. That excluded data used for national security, according to Diego Naranjo, an advocate at European Digital Rights (EDRi), a Brussels-based nonprofit.