Abstract
Biometric technologies have been gaining popularity lately. An increasing number of enterprises and public entities worldwide are using them for security measures. Many universities in the European Union have also begun to recognise the benefits of implementing biometric systems in their organisations, and it is just a matter of time before universities in Poland join them as well. However, biometric data used by such systems are especially sensitive as they may reveal intimate information about data subjects. As such, they are counted among special categories of personal data, the processing of which is in principle prohibited by art. 9 (1) GPDR. Furthermore, the processing of students’ personal data demands special care from universities as they are vulnerable data subjects. Students are namely subordinate to university authorities, which significantly limits their scope of autonomy. Therefore, the use of biometric technologies poses a challenge for universities in Poland. The following article aims to present the main reasons why students are vulnerable data subjects and which legal grounds provided by GDPR are most suitable for processing their biometric data by universities.