European UnionGDPR Article 9, Special Categories of Personal Data
Regulation (EU) 2016/679, Art. 9
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Consent, Biometric
- Audit expectation
- none
What it requires
- Obtain explicit consent, or establish another Article 9(2) basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
- Treat any biometric identifier your system derives through its own technical processing for the purpose of uniquely identifying a person as special category data, even where the underlying image or audio was lawfully public.
These lines are LexLint's reading of the law's text. Also read by: GBA/APD Biometric Recommendation and Enforcement, Special Categories (guidance from the Belgian Data Protection Authority, issued ); GDPR Article 9 and LOPDGDD Article 9, Special Categories of Personal Data in Spain (guidance from the Spanish Data Protection Agency); European Data Protection Board (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 83(5)(a) names Article 9 directly among the basic-principles-for-processing provisions carrying the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The data protection supervisory authority designated by each EU Member State under Article 51, coordinated on cross-border cases through the one stop shop mechanism, which does not apply to processing by public authorities or by private bodies acting under Article 6(1)(c) or (e) (Article 55(2)), and through the European Data Protection Board (Articles 68-76).
Enforcement record
Counts the fines that national data protection authorities imposed in calendar year 2025 (2,161): the sum of the number-of-fines column in the European Data Protection Board's Annual Report 2025, which gives for each of 30 authorities (the 27 Member States, Iceland, Liechtenstein and Norway) the number and the total amount of the fines it issued that year. The report's own total of those amounts is EUR 1,145,760,374. Fines only: the table does not count the reprimands, warnings, compliance orders or processing bans the authorities may also impose. Enforcement of the GDPR is national, and this table is the Board's Union-level count of it. The figures describe enforcement of the GDPR as a whole, not enforcement of Article 9 alone.
- As of
- Currency
- EUR
- Source link
- https://www.edpb.europa.eu/system/files/2026-04/edpb-annual-report-2025_en.pdf
- Fines per year
- 1,145,760,374
- Actions per year
- 2,161
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201903_video_devices_en_0.pdf
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber)
- Guidance body
- European Data Protection Board
- Open questions
- Does a controller that derives a faceprint or voiceprint from a publicly available image or recording, but does not use it 'for the purpose of uniquely identifying a natural person', process special categories of data under Article 9(1), as paragraph 75 of the Board's video guidelines frames the test?
- Can Article 9(2)(e) apply to a photograph or recording that someone other than the person shown made public, given the Court's ruling in Case C-252/21 that a user manifestly makes data public only where he or she explicitly made that choice beforehand?
What it makes you log
Logging duty
Article 9(1) prohibits processing the listed special categories of personal data, including biometric data processed to identify a natural person uniquely, and Article 9(2) lists the exceptions. Neither paragraph names a log, record or document. A controller that relies on consent must be able to demonstrate it under Article 7(1), which this row does not cite.
- Kind
- None
- As of
Also on the record
EEA status
- Annex
- XI
- Status
- Incorporated
- Force date
- Joint committee decision number
- 154/2018
- Source link
- https://www.efta.int/eea-lex/32016r0679
- Decision date
What this law does
Article 9(1) prohibits processing special categories of personal data, namely personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, unless a listed Article 9(2) exception applies, such as the data subject's explicit consent.
Article 4(14) defines biometric data as data from specific technical processing of physical, physiological or behavioural characteristics, with the statute's own examples (facial images, fingerprint data) stated as non-exhaustive, so the same definition reaches a voiceprint once a system derives an identification capable template from audio, even though the text never uses the word voice.
Recital 51 confirms an ordinary photograph is not itself biometric data and only becomes covered when processed through a specific technical means allowing unique identification, so a faceprint a controller derives from one, even from a publicly available photograph, is newly covered special category data; the General Data Protection Regulation (GDPR) text does not separately discuss audio recordings.
The Dutch data protection authority fined Clearview AI EUR 30.5 million (decision dated , publicly announced ) for building a facial recognition database from photographs scraped off the public internet without an Article 9 basis.
The Dutch decision itself catalogs parallel GDPR enforcement against Clearview by other Member State authorities on the same underlying conduct, including the Italian Garante (decision dated ) and the French CNIL (decision dated ). The Hellenic Data Protection Authority separately fined Clearview EUR 20,000,000 for the same conduct on .
How courts have read itPremium data
Our analysis of this law draws on 6 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- GBA/APD Biometric Recommendation and Enforcement, Special Categories, the Belgian Data Protection Authority
- GDPR Article 9 and LOPDGDD Article 9, Special Categories of Personal Data in Spain, the Spanish Data Protection Agency
When LexLint raises it
When your app profile says your app processes biometric data, crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .