Under the GDPR, factory footage of a worker is personal data, and biometric data only when processed to identify them

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

EAD-2026-0017

Kind

Access rule

Jurisdiction

European Union

Last verified

13 September 2026

Added

13 September 2026

• GDPR article 4(1): personal data is any information relating to an identified or identifiable natural person. Article 4(14): biometric data results from specific technical processing of physical, physiological or behavioural characteristics.
• Recital 51: photographs are biometric only when processed through a specific technical means allowing unique identification or authentication.
• EDPB Guidelines 3/2019 on video devices, version 2, adopted 29 January 2020: footage of an individual cannot in itself be considered biometric data under article 9 if it has not been specifically technically processed.
• The same guidelines set three criteria for biometric data: the nature of the data, a specific technical processing, and the purpose of uniquely identifying a person.

Recording people in a European workplace to train a robot needs a lawful basis, information to the people recorded, and a retention rule, and the usual basis for workers is not consent. It does not need the article 9 regime unless the pipeline identifies individuals. Blurring faces before training removes the harder question and often the personal data itself.

1. Regulation (EU) 2016/679, the GDPRPrimary · 4 May 2016
2. European Data Protection Board, Guidelines 3/2019 on processing of personal data through video devicesPrimary · 29 January 2020

• Open questionOpen questionEAD-2026-0027

  Open question: does a person in a training ground's footage have a say? Three regimes, three different answers, none written for robots

  Global · verified 13 September 2026

  GDPR and the EDPB video guidelines: footage of an identifiable person is personal data; it is biometric only when processed to identify. Workers are owed a lawful basis and information, and consent is a weak basis at work.

• VerifiedAccess ruleEAD-2026-0031

  US state biometric laws: Washington excludes video recordings from the definition, Texas needs consent for face geometry, and the Illinois text could not be reached

  United States · verified 13 September 2026

  RCW 19.375.020(1): a person may not enrol a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent, and providing a mechanism to prevent later use.

• VerifiedAccess ruleEAD-2026-0011

  Hours recorded in China leave the country under the 2024 cross border provisions and the 2025 network data regulations

  China · verified 13 September 2026

  Cyberspace Administration provisions, article 2: a handler need not declare data for an outbound security assessment as important data unless notified by a department or region or it is publicly listed as such.

• Open questionOpen questionEAD-2026-0019

  Open question: can hours recorded in a Chinese training ground train a robot sold in the European Union?

  European Union · verified 13 September 2026

  The Data Act allocates data a connected product generates among user, holder and third party; it says nothing about the provenance of training data.

• VerifiedAccess ruleEAD-2026-0018

  The AI Act reaches robots as machinery through the old Machinery Directive, and learned safety behaviour needs third party assessment from January 2027

  European Union · verified 13 September 2026

  AI Act Annex I, section A, item 1: Directive 2006/42/EC on machinery. The string 2023/1230 does not appear in the AI Act.

• AbsentData supplyEAD-2026-0016

  No EU or member state program funds robot training data collection as its object

  European Union · verified 13 September 2026

  euROBIN, coordinated by DLR, runs from July 2022 to December 2026 with an EU contribution of 11,499,999 euro; its stated exchange is software, data and knowledge over the EuroCore repository among its own labs.