Czech RepublicGDPR Article 9, Special Categories of Personal Data
Regulation (EU) 2016/679, Art. 9
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Obtain an explicit General Data Protection Regulation (GDPR) Article 9(2) legal basis before processing biometric, health, or other special-category personal data of a person in the Czech Republic.
These lines are LexLint's reading of the law's text. Also read by: Úřad pro ochranu osobních údajů (Office for Personal Data Protection, Czech Republic) (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of the Court of Justice of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://uoou.gov.cz/cinnost/ochrana-osobnich-udaju/ukoncene-kontroly/kontroly-za-rok-2024-1/kontrolni-cinnost-v-oblasti-ochrany-osobnich-udaju-2024/zamestnavatel-vyuzivajici-dochazkovy-system-na-biometricke-udaje-uoou-0433223
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of the Court of Justice of (Grand Chamber)
- Guidance body
- Úřad pro ochranu osobních údajů (Office for Personal Data Protection, Czech Republic)
- Open questions
- Which spaces are objects and premises that form part of an international airport for an isolated system of real-time remote biometric identification under Section 39a(1) of Act No. 110/2019 Sb.?
What it makes you log
Logging duty
Article 9(1) prohibits processing special categories of data, including biometric data used to identify a person, and Article 9(2) lists the exceptions. Neither states a duty to create, keep or produce a log or record. Section 39a(5) of Act No. 110/2019 Sb. has an authority that operates an airport remote biometric identification system keep the data from that processing, with the time, camera and registration number, in a separate register for 90 days and report each access to the Office within 72 hours; Section 39a(1), the only part of that section this entry cites, defines the system and states no record duty.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) prohibits processing special categories of personal data, namely personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, absent an Article 9(2) ground.
Section 39a(1) of Act No. 110/2019 Sb. defines an isolated system as an artificial intelligence system for real-time remote biometric identification of natural persons that a managing authority uses in a space limited to the buildings and premises of an international airport.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .