GermanyGDPR Article 9 and BDSG Section 26(3), Special Categories of Personal Data and Their Processing for Employment in Germany
Regulation (EU) 2016/679, Art. 9; Bundesdatenschutzgesetz (BDSG) §26(3)
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Where you deploy a biometric time clock, access control system, or voice-authentication system for employees in Germany, satisfy BDSG Section 26(3)'s conditions rather than relying on employee consent as the sole basis.NIST Privacy FrameworkCT.PO-P1
- Treat any biometric identifier your system derives through its own technical processing as General Data Protection Regulation (GDPR) Article 9 special category data, whether or not the source photo or audio was publicly available.NIST Privacy FrameworkID.IM-P6
These lines are LexLint's reading of the law's text. Also read by: Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (Datenschutzkonferenz, joint body of the German data protection authorities) (guidance, recorded ); Case C-65/23 K GmbH (Employment-data rules), judgment of the Court of Justice of (First Chamber) (recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0065
- Guidance link
- https://www.datenschutzkonferenz-online.de/media/kp/dsk_kpnr_17.pdf
- Case citation
- Case C-65/23 K GmbH (Employment-data rules), judgment of the Court of Justice of (First Chamber)
- Guidance body
- Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (Datenschutzkonferenz, joint body of the German data protection authorities)
- Open questions
- Does Section 26(3) of the Bundesdatenschutzgesetz, which allows special categories of data in employment where necessary and the employee's interest does not prevail, meet the requirements of Article 9(2) and Article 88(2) of Regulation (EU) 2016/679 that Case C-65/23 applies to employment-data rules?
What it makes you log
What the log must hold
Actor identity
Logging duty
Section 26, paragraph 3 applies Section 22, paragraph 2, which requires appropriate and specific safeguards for special categories of data and lists among those that may be taken a measure ensuring that it can be checked afterwards whether and by whom personal data were entered, changed or removed. The list gives examples and fixes no format, owner or period. Regulator powers to demand records sit in BDSG Section 40, outside the provisions this instrument cites.
- Kind
- Implicit
- As of
- Provision
- BDSG Section 26, paragraph 3, sentence 3, applying Section 22, paragraph 2, number 2
- Trigger
- personal_data_processing
What this law does
General Data Protection Regulation (GDPR) Article 9(1) prohibits processing special categories of personal data, namely personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
BDSG Section 26(3) allows special categories of data to be processed for employment purposes where that is necessary to exercise rights or meet legal duties under employment law, social security law and social protection law and nothing suggests that the person's interest in excluding the processing prevails. Under Section 26(2), the dependence of the employee and the circumstances in which consent was given are weighed in judging whether consent is voluntary.
Under Section 26(3), consent to the processing of special categories must expressly refer to those data. In Case C-34/21 (judgment of ), the CJEU held that national legislation cannot be a 'more specific rule' under Article 88(1) of the GDPR where it does not meet the conditions of Article 88(2). A voiceprint or faceprint captured for identification is covered identically to a fingerprint. GDPR draws no distinction by modality.
On the Hamburg Commissioner for Data Protection and Freedom of Information ordered Clearview AI to remove the biometric data of a German citizen who had made an access request.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .