Facial biometric data: what it is and how the LGPD treats it
Quick facts
- Definition
- A physical characteristic of the face that identifies a person, such as the set of features used in facial recognition.
- Under the LGPD
- Biometric data, when linked to a natural person, is sensitive personal data (art. 5, II).
- In the clinic
- The patient's frontal photo and facial landmark maps come into the discussion.
- Caution
- Clear legal basis, defined purpose, restricted access, and secure storage.
Facial biometric data is information about the physical characteristics of the face that makes it possible to identify a person: the distance between the eyes, the contour, the relationship between features. Facial recognition systems turn those features into a numeric pattern. The LGPD (Brazil's personal data protection law) classifies biometric data, when linked to a natural person, as sensitive personal data (art. 5, item II).
What about the patient's photo?
A face photo is personal data and, in a health context, also carries sensitive information. Even without facial recognition, the image of the face identifies the patient and requires care. In a facial harmonization clinic, clinical photos are part of the patient record and the assessment, while marketing photos serve a different purpose that requires specific authorization.
What should the clinic take care of?
| Point | Care |
|---|---|
| Purpose | Tell the patient what the photo will be used for |
| Legal basis | Health care, consent, or another appropriate basis |
| Marketing use | Specific, revocable image use release |
| Access | Restricted to those who need it; not circulated in messaging groups |
| Storage | Secure location, with a backup and a defined retention period |
| Incident | A plan for a security incident |
What does Harmy do with the face?
How should you guide the patient?
If the clinic needs to share an image for teaching or research, anonymizing a face is difficult, because the features identify the person. Covering the eyes is not always enough.
Frequently asked questions
Is a photo of the face biometric data?
A photo is personal data. It becomes biometric data when it is processed to identify the person by their features. In any case, it calls for care and a clear purpose.
Can the clinic keep a patient's photo?
Yes, with a defined purpose and an appropriate legal basis, such as consent or the provision of care, and with secure storage. Use in marketing requires specific authorization.