FinlandGDPR Article 9 and Data Protection Act Section 6, Special Categories in Finland
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Ground the processing of any biometric identifier of a person in Finland, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent, unless it falls within one of the eight contexts Data Protection Act Section 6 lists, none of which is biometric-specific.
These lines are LexLint's reading of the law's text. Also read by: European Data Protection Board (guidance, recorded ); Case C-184/20 OT v Vyriausioji tarnybinės etikos komisija, judgment of the Court of Justice (Grand Chamber) of (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0184
- Guidance link
- https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201903_video_devices_en_0.pdf
- Case citation
- Case C-184/20 OT v Vyriausioji tarnybinės etikos komisija, judgment of the Court of Justice (Grand Chamber) of
- Guidance body
- European Data Protection Board
- Open questions
- Does a biometric comparison that only authenticates a claimed identity count as processing 'for the purpose of uniquely identifying a natural person' under Article 9(1) of the GDPR, when Recital 51 refers to 'the unique identification or authentication of a natural person'?
- Does section 6(2) of the Tietosuojalaki, which lifts Article 9(1) for 'tietojen käsittelyyn, josta säädetään laissa', reach a private controller's biometric processing when a law gives that controller a public-interest task, with no Article 9(2) condition of its own?
What it makes you log
What the log must hold
Actor identity
Logging duty
Where special categories of personal data are processed under Section 6, the controller and the processor take suitable and specific measures to safeguard the data subject, and the first measure the Act lists is one that makes it possible afterwards to verify and establish who recorded, altered or transferred the data. Article 9 itself states no log or record duty. Section 6 lists a procedure for regularly testing and assessing the effectiveness of the measures but sets no cadence and names no reviewer, and the Ombudsman's information and inspection power sits in Section 18, which this entry does not cover.
- Kind
- Explicit
- As of
- Provision
- Data Protection Act (Tietosuojalaki 1050/2018), Section 6, second paragraph, point 1; Regulation (EU) 2016/679, Art. 9
- Trigger
- personal_data_processing
What this law does
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category.
Data Protection Act Section 6, read in full, lifts the Article 9(1) bar in eight named contexts (an insurer assessing or determining its liability, processing provided for by law or necessary for a public-interest task that the law gives the controller, trade union membership for employment law, healthcare and social welfare delivery, anti-doping and disability sports, and research, statistics or archiving); none of the eight names biometric data, and the section carries no illustrative list or enumeration of biometric identifier types.
Biometric data processed for unique identification is therefore governed directly by GDPR Article 9 itself, with no Finland-specific narrowing or widening of the definition.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .