Biometric data is considered a special category requiring explicit consent under the EU’s new General Data Protection Regulation law, which goes into effect Friday.