BelgiumAct of 30 July 2018 Articles 8-10, Special-Category Processing Grounds
Loi du 30 juillet 2018, Arts. 8-10
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Designate the specific staff with access to genetic, biometric, or health data of a person in Belgium, keep that list available to the GBA/APD, and bind those staff to confidentiality, per Act Article 9.
- Do not treat a photo, video, or audio recording as processable merely because it is public; Belgium's own lawful-basis ground for manifestly public data is keyed to an affirmative act by the data subject, not a scope exclusion.
These lines are LexLint's reading of the law's text. Also read by: Gegevensbeschermingsautoriteit (Belgian Data Protection Authority) (guidance, recorded ); Case C-184/20 OT v Vyriausioji tarnybinės etikos komisija, judgment of the Court of Justice of (Grand Chamber) (recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0184
- Guidance link
- https://www.gegevensbeschermingsautoriteit.be/professioneel/thema-s/gevoelige-gegevens
- Case citation
- Case C-184/20 OT v Vyriausioji tarnybinės etikos komisija, judgment of the Court of Justice of (Grand Chamber)
- Guidance body
- Gegevensbeschermingsautoriteit (Belgian Data Protection Authority)
- Open questions
- Does Article 9 of the Act of require the list of persons with access and their confidentiality undertaking for a system that derives biometric data only transiently, without storing a template?
What it makes you log
Who may demand the log
Regulator
Logging duty
The Act requires the controller, and any processor, to draw up a list of the categories of persons who have access to the special-category data, with a description of each category's function, and to keep that list available to the supervisory authority. The clause names no log of individual accesses and no retention period.
- Kind
- Implicit
- As of
- Provision
- Article 9, point 2, and Article 8, paragraph 2 (a list of the categories of persons with access to special-category data, kept available to the supervisory authority)
- Trigger
- personal_data_processing
What this law does
General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category. Article 9 of the Act requires every controller processing genetic, biometric, or health data to designate the categories of staff with access, keep that list available to the supervisory authority, and bind those staff to confidentiality.
Article 8, paragraph 1's final subparagraph outright prohibits genetic and biometric processing for unique identification by the specific associations and foundations it authorizes under Article 9(2)(g), absent particular legal provisions. Article 10, paragraph 1, point 6 makes processing of criminal-conviction data manifestly made public by the data subject a lawful-basis ground, not a scope exclusion.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .