The ruling in part reflects a tension between how biometrics are often used in practice and the definition of biometrics as “special category data” under GDPR.