CyprusGDPR Article 9 and Law 125(I)/2018, Genetic and Biometric Data in Cyprus
Regulation (EU) 2016/679, Art. 9; Law 125(I)/2018
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Do not process genetic or biometric data of a person in Cyprus for life or health insurance purposes, per Law 125(I)/2018's insurance prohibition.
- Where you process genetic or biometric data of a person in Cyprus on the basis of the person's consent, obtain a separate consent from that person for any further processing of that data, per Law 125(I)/2018 section 9(2).
These lines are LexLint's reading of the law's text. Also read by: Γραφείο Επιτρόπου Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Office of the Commissioner for Personal Data Protection, Cyprus) (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of the Court of Justice of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://www.gov.cy/dataprotection/plirofories-gia-organismoys/sychnes-erotiseis/
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of the Court of Justice of (Grand Chamber)
- Guidance body
- Γραφείο Επιτρόπου Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Office of the Commissioner for Personal Data Protection, Cyprus)
- Open questions
- Does the separate consent that Article 9(2) of Law 125(I)/2018 requires for further processing of genetic and biometric data apply to a further processing that is compatible with the original purpose under Article 5(1)(b) of Regulation (EU) 2016/679?
What it makes you log
Logging duty
Section 9 of the Law prohibits processing genetic and biometric data for health and life insurance and requires a separate consent for further processing based on consent. It asks for no log or record.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Section 9(1) of Law 125(I)/2018 prohibits the processing of genetic and biometric data for health and life insurance purposes. Under section 9(2), where that processing rests on the data subject's consent, the further processing of the data requires a separate consent from the data subject. The Law's definition of biometric data in section 2(1) gives facial images and fingerprint data as its examples.
When LexLint raises it
When your app profile says your app processes biometric data or is an insurer.
Back to the example · Lint your app
Page updated .