DenmarkGDPR Article 9, Special Categories of Personal Data as Applied in Denmark
Regulation (EU) 2016/679, Art. 9
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Ground the processing of any biometric identifier of a person in Denmark, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent.
These lines are LexLint's reading of the law's text. Also read by: Datatilsynet (the Danish Data Protection Agency) (guidance, recorded ); Case C-184/20 OT v Vyriausioji tarnybinės etikos komisija, judgment of the Court of Justice (Grand Chamber) of (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0184
- Guidance link
- https://www.datatilsynet.dk/afgoerelser/afgoerelser/2019/maj/vejledende-udtalelse-om-anvendelsen-af-fingeraftryk-til-brug-for-registrering-af-ansattes-komme-gaa-tider
- Case citation
- Case C-184/20 OT v Vyriausioji tarnybinės etikos komisija, judgment of the Court of Justice (Grand Chamber) of
- Guidance body
- Datatilsynet (the Danish Data Protection Agency)
- Open questions
- Does a comparison of a presented fingerprint with a single stored template, which Datatilsynet calls 'verifikation (autentifikation)', fall outside the prohibition on processing biometric data for the purpose of uniquely identifying a person in Article 9(1) of the GDPR?
What it makes you log
Logging duty
Article 9(1) prohibits processing special categories of data, including biometric data used to identify a person, and Article 9(2) lists the exceptions. Neither states a duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for the purpose of uniquely identifying a natural person as a special category of personal data, prohibited absent an Article 9(2) ground such as explicit consent. The Danish Data Protection Act does not mention biometric data: its section 7 treats every Article 9(1) category alike, so the Act has no list of biometric identifier types and no biometric-specific rule.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .