Identification

Legal Framework

Identification sits at the threshold of the GDPR: the entire regulation applies only where personal data — information linked to an identified or identifiable person — is processed. Article 4(1) GDPR defines the scope of identifiability broadly, encompassing direct and indirect identifiers including names, identification numbers, location data, and online identifiers. This definitional anchor determines whether the GDPR applies at all and triggers the full suite of obligations.

Article 11(1) GDPR provides a counterweight: if the controller's purposes do not require identifying the data subject, the controller need not acquire additional data solely to comply with the Regulation. Article 11(2) GDPR then suspends Articles 15 to 20 unless the data subject supplies supplementary information enabling identification. Article 5(1)(e) GDPR reinforces the temporal dimension — data may be kept in identifiable form no longer than necessary.

"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"
— GDPR Art. 4(1)

National identification numbers receive separate treatment under Article 87 GDPR, which permits Member States to set specific conditions for their processing, provided appropriate safeguards are in place.

Key Developments

The Hoge Raad's June 2026 ruling in the ICS credit card case (24/02161) crystallises the contested boundary between routine identity verification and biometric processing under Article 9(1) GDPR. The case centred on a cardholder who refused to submit a "selfie" and identity document copy for online verification under anti-money-laundering rules. The court examined whether storing a passport photograph constitutes processing of biometric data intended for unique identification — a question that determines whether the Article 9 prohibition and its narrow exceptions apply.

"Het gaat in deze zaak om een nieuwsbericht dat de rechtbank heeft gepubliceerd over een eindvonnis in een strafzaak."
— Hoge Raad, 19-12-2025 (25/02870) ¶4

The EDPB's Opinion 11/2024 draws a functional distinction between authentication (1-to-1 verification) and identification (1-to-many database search), both of which nonetheless constitute processing of special-category biometric data under Article 9 GDPR. This distinction matters for proportionality assessment but does not exempt authentication from the Article 9 framework.

Status of the Debate

This topic is actively contested in court. The Hoge Raad's 2026 ICS ruling directly addresses whether storing photographs for identity purposes triggers biometric-data protections — a question on which lower courts had diverged. The doctrinal fault line runs through Article 4(14) GDPR: whether a photograph constitutes biometric data only when technical processing enables recognition, or whether any storage of facial images for identification purposes suffices. CJEU guidance on this interpretive question would resolve the ambiguity. Until then, controllers face uncertainty when AML obligations push them toward photographic identification methods that may engage Article 9 protections.

Practical Guidance

• Map identification methods against Article 9 thresholds. Determine whether any identification process involving facial images, fingerprints, or other biometric techniques constitutes processing "for the purpose of uniquely identifying a natural person" under Article 4(14) GDPR. If so, an Article 9(2) exception must be satisfied before processing.
• Apply Article 11 where identification is unnecessary. Where processing purposes do not require identifying individuals — for example, pure statistical or pseudonymised research — invoke Article 11(1) GDPR and avoid acquiring supplementary data solely for compliance purposes.
• Enforce storage limitation under Article 5(1)(e). Maintain identification data in identifiable form only for as long as genuinely necessary; implement automated retention schedules and deletion triggers tied to the original processing purpose.
• Distinguish authentication from identification functionally but not legally. While the EDPB recognises a technical distinction, both uses fall within Article 9 GDPR. Ensure a lawful basis under Article 9(2) exists for either function.
• Assess national ID number conditions under Article 87. Where processing involves national identification numbers, verify that Member State-specific conditions and appropriate safeguards are satisfied, as permitted by Article 87 GDPR.