AustriaGDPR Article 9, Special Categories of Personal Data, as Applied in Austria
Regulation (EU) 2016/679, Art. 9
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain explicit consent, or establish another General Data Protection Regulation (GDPR) Article 9(2) basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.NIST Privacy FrameworkCT.PO-P1
- Treat any biometric identifier your system derives through its own technical processing as special category data under Austrian and EU law alike, even where the underlying image or audio was lawfully public.NIST Privacy FrameworkID.IM-P6
These lines are LexLint's reading of the law's text. Also read by: Datenschutzbehörde (Austrian Data Protection Authority) (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of the Court of Justice of (Grand Chamber) (recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://www.dsb.gv.at/faqs/besondere-datenkategorien
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of the Court of Justice of (Grand Chamber)
- Guidance body
- Datenschutzbehörde (Austrian Data Protection Authority)
- Open questions
- Does a person who posts a photo, video or recording publicly make the faceprint or voiceprint derived from it manifestly public under Article 9(2)(e) of Regulation (EU) 2016/679, when the Court of Justice requires an explicit prior choice to make data publicly accessible to an unlimited number of persons?
What it makes you log
Logging duty
Article 9(1) prohibits processing special categories of personal data unless an exception in Article 9(2) applies. It asks the controller for no log or record, and neither does the row's Austrian guidance.
- Kind
- None
- As of
What this law does
Article 9(1) prohibits processing special categories of personal data, namely personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, unless a listed Article 9(2) exception applies, most often explicit consent.
A voiceprint captured through specific technical processing for identification falls within the General Data Protection Regulation (GDPR) definition of biometric data, as a faceprint does. In a decision of , the Datenschutzbehörde concluded that Clearview AI had processed personal data of an Austrian complainant who had made an access request.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .