BelgiumGBA/APD Biometric Recommendation and Enforcement, Special Categories
GBA/APD Aanbeveling nr. 01/2021; GBA/APD Beslissing ten gronde nr. 114/2024
Guidance, not a law: the Belgian Data Protection Authority's reading of GDPR Article 9, Special Categories of Personal Data. It binds nobody by itself; the law it reads does.
Guidance on a biometric privacy rule, addressed to public and private bodies.
- Excludes recording-derived identifiers
- No
- Instrument type
- guidance published by a regulator
- Audit expectation
- on_request
- Who audits it
- Regulator
What the regulator expects
- Do not rely on employee consent as the legal basis for a workplace biometric time-registration or access system in Belgium.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Gegevensbeschermingsautoriteit issued Recommendation 01/2021 itself, so the recommendation is the authority's own guidance on biometric data.
- As of
- Guidance link
- https://www.gegevensbeschermingsautoriteit.be/professioneel/thema-s/gevoelige-gegevens
- Guidance body
- Gegevensbeschermingsautoriteit (Belgian Data Protection Authority)
- Open questions
- On what legal basis other than explicit consent may an employer in Belgium process fingerprints or other biometric data to authenticate staff, given that the Gegevensbeschermingsautoriteit finds a gap in Belgian law outside eID and passport processing?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Actor identity, Data lineage
Logging duty
The Litigation Chamber applies the GDPR Article 30 duty to keep a register of processing activities to an employer's fingerprint time-registration of its staff, finds the register incomplete and partly inaccurate, and also finds a breach of the accountability duty in Article 5(2).
- Kind
- Explicit
- As of
- Provision
- GDPR Article 30(1), points (a) to (d), as applied in Litigation Chamber Decision 114/2024, paragraphs 136 to 142 and 204
- Trigger
- personal_data_processing
Why the legislator wanted it
Paragraph 141 of the Litigation Chamber's decision (the Belgian Data Protection Authority) says the register is the controller's own instrument for complying with the GDPR and underlies every obligation the GDPR places on the controller.
- As of
- Quote
- De Geschillenkamer is van oordeel dat het verwerkingsregister een essentieel instrument is in het kader van de reeds vermelde verantwoordingsplicht (artikel 5.2 en artikel 24.1 AVG)
- Source link
- https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-114-2024.pdf
- Source kind
- Regulator guidance
- Purpose
- accountability_demonstration
What this law does
The Belgian Data Protection Authority's (GBA/APD) reading of General Data Protection Regulation (GDPR) Article 9 for biometric data, listed with that article as guidance. Belgium has no dedicated biometric-identifier statute; a biometric identifier is GDPR Article 9(1) special-category data, plus Act Article 9's access-designation and confidentiality duties.
GBA/APD Recommendation 01/2021 concludes there is at present a lacuna in Belgian law such that any biometric authentication processing lacking explicit consent, other than eID and passport processing, has no legal basis. Litigation Chamber Decision 114/2024 fined an employer 45,000 EUR for fingerprint-based workplace time registration, holding that employee consent failed the power-imbalance analysis and that record-keeping and DPIA duties were also breached.
Back to the example · Lint your app
Page updated .