Scenario:A financial institution collectsbiometric data of its clients, such asface recognition, to support apayment authentication...

UnderArticle 35(3)(b) of GDPR, aDPIA is mandatoryfor processing that involveslarge-scale processing of special category data, including biometric data. Even ifexplicit consentis obtained,the risks associated with biometric processing require further evaluation.

Option A is correctbecausebiometric data processing poses high risks to fundamental rights and freedoms, necessitating a DPIA.

Option B is incorrectbecauseobtaining consent does not eliminate the requirement to conduct a DPIA.

Option C is incorrectbecauseDPIAs are required for biometric processing regardless of scaleif risks are present.

Option D is incorrectbecausestorage duration is not a determining factor for DPIA requirements.

References:

GDPR Article 35(3)(b)(DPIA requirement for special category data)

Recital 91(Processing biometric data requires special safeguards)