GreeceGDPR Article 9 and Law 4624/2019, Special Categories in Greece
Regulation (EU) 2016/679, Art. 9; Law 4624/2019
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Ground the processing of any biometric identifier of a person in Greece, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent, unless the processing falls within the derogation in Article 22(1) of Law 4624/2019 for social security and social protection or for the assessment of an employee's working capacity.
These lines are LexLint's reading of the law's text. Also read by: Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber)
- Open questions
- Does a controller that derives a faceprint or voiceprint from a publicly available image or recording, but does not use it 'for the purpose of uniquely identifying a natural person', process special categories of data under Article 9(1), as paragraph 75 of the Board's video guidelines frames the test?
- Which measures beyond the examples listed in the Article are 'appropriate and specific' safeguards for the interests of the data subject under Article 22(3) of Law 4624/2019?
What it makes you log
What the log must hold
Actor identity
Logging duty
Where special-category data are processed under the derogations in Article 22 of the Law, the controller must take all appropriate and specific measures to safeguard the data subject, and the Law lists among them measures to ensure that ex post verification of whether and by whom personal data have been entered, amended or removed is possible, which can be shown only from a record. The list is introduced by "may include in particular", names no log fields beyond who made the change, and sets no audit and no one entitled to demand the record. Item (h) of the same list names procedures for regularly testing the security measures, which fixes no audit cadence. GDPR Article 9 sets no record duty of its own.
- Kind
- Implicit
- As of
- Provision
- Law 4624/2019, Article 22(3)(b)
- Trigger
- personal_data_processing
What this law does
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Article 22(1) of Law 4624/2019 allows public and private bodies, by way of derogation from GDPR Article 9(1), to process special categories of personal data where necessary for exercising rights under social security and social protection law and fulfilling the related obligations, or for purposes that include preventive medicine and the assessment of the working capacity of the employee.
Under Article 22(3), all appropriate and specific measures must be taken to safeguard the interests of the data subject in those cases.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .