GDPR Article 9, Special Categories of Personal Data Including Biometric Data, as Applied in Austria

Regulation (EU) 2016/679, Art. 9, as applied in Austria

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 25 May 2018.

A sensitive categories rule binding public and private bodies.

As of 24 August 2026.

What it requires

Obtain explicit consent, or establish another General Data Protection Regulation (GDPR) Article 9(2) basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
Treat any biometric identifier your system derives through its own technical processing as special category data under Austrian and EU law alike, even where the underlying image or audio was lawfully public.

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 9(1) prohibits processing special categories of personal data, including biometric data processed to uniquely identify a person, unless a listed Article 9(2) exception applies, most often explicit consent. Austria adds no separate statutory biometric regime alongside General Data Protection Regulation (GDPR) Article 9. The Datenschutzbehorde found in 2021 that Clearview AI's scraped facial recognition database was unlawful under Austrian data protection law for processing biometric data without a lawful basis.

No Austria-specific guidance on voiceprint biometrics is identified; the GDPR baseline, that a voiceprint captured through specific technical processing for identification is special category data on the same footing as a faceprint, governs by default.

When LexLint raises it

processes_biometrics
processes_voice
high_risk_decisions

Read the law

Official Journal text, EUR-Lex, Regulation (EU) 2016/679
DSB Clearview AI decision (2021)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app