Authorisation concerning data subject's criminal behaviour or biometric information
(1) The prohibition on processing personal information concerning a data subject's criminal behaviour or biometric information, as referred to in section 26, does not apply if the processing is carried out by bodies charged by law with applying criminal law or by responsible parties who have obtained that information in accordance with the law.
(2) The processing of information concerning personnel in the service of the responsible party must take place in accordance with the rules established in compliance with labour legislation.
(3) The prohibition on processing any of the categories of personal information referred to in section 26 does not apply if such processing is necessary to supplement the processing of information on criminal behaviour or biometric information permitted by this section.
What this means for your estate
- This is the section that actually opens the door to biometric access-control data, but only where the estate “obtained that information in accordance with the law” (subsection (1)), which loops straight back to needing a proper lawful basis and consent process, not a blanket authorisation.
- A criminal background check on prospective security staff or a new resident isn't automatically covered, subsection (1) requires the information to have been obtained lawfully in the first place, so the check itself has to run through a compliant process (typically consent, per s.27).
PopiGuard's Policy Vault includes a biometric-access consent template built to satisfy the “obtained in accordance with the law” standard in subsection (1).