IcelandAct No. 90/2018 Article 3 Item 3 and Article 11, Sensitive Personal Data in Iceland
Log nr. 90/2018, Art. 3, item 3, point (e), Art. 9, Art. 11
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Before processing biometric data of a person in Iceland to identify that person uniquely, including a faceprint, meet one of the lawful bases in Act No. 90/2018 Article 9 and one of the further conditions in Article 11, such as the data subject's explicit consent.
- Do not assume voice capture is excluded from the biometric-data definition in Article 3, item 3, point (e) merely because the Act's illustrative examples name only facial images and fingerprint data; the definition's own operative test is specific technical processing for unique identification, not the modality named as an example.
These lines are LexLint's reading of the law's text. Also read by: Persónuvernd and the Icelandic State v Reykjavíkurborg, Supreme Court of Iceland (Hæstiréttur Íslands), Case No. 18/2024, judgment of (recorded ).
Who enforces it
Settledness
The judgment concerns a school learning platform and the classification of teacher feedback, not biometric data.
- As of
- Case link
- https://island.is/domar/s-2C2A2D4B-4092-47D2-BF61-2A79EE35EAA8
- Case citation
- Persónuvernd and the Icelandic State v Reykjavíkurborg, Supreme Court of Iceland (Hæstiréttur Íslands), Case No. 18/2024, judgment of
- Open questions
- Does a voiceprint count as biometric data under Article 3, item 3, point (e) of Act No. 90/2018, which gives 'andlitsmyndir eða gögn um fingraför' (facial images or fingerprint data) as examples and limits the term to data processed 'í því skyni að persónugreina einstakling með einkvæmum hætti' (for the purpose of uniquely identifying an individual)?
What it makes you log
Logging duty
Article 3 item 3 defines sensitive personal data, including biometric data, and Article 11 forbids processing it unless a lawful basis in Article 9 and a further condition in Article 11 is met, the first being the data subject's explicit consent. None of these provisions makes the controller keep, show or produce a record, so no record duty is found. Article 10 (the controller must be able to show consent) and Article 26 (register of processing activities) are not articles this row cites; they sit on the whole-Act row. No scope clause is stated in the cited provisions.
- Kind
- None
- As of
What this law does
Act No. 90/2018, Article 3, item 3 defines sensitive personal data as information on race, ethnic origin, political opinions, religion, life stance (lífsskoðun, philosophical belief) or trade union membership (point (a)); health information, being personal data on a person's physical or mental health, including health services received, and information on drug, alcohol and substance use (point (b)); information on a person's sex life and sexual orientation (point (c)); genetic information (point (d)); and biometric data (point (e)), which it defines as personal data obtained through specific technical processing relating to a person's physical, physiological or behavioral characteristics that allow or confirm unique identification, giving facial images and fingerprint data as illustrative examples using a non-exhaustive such as construction, where the data is processed to identify the person uniquely.
It does not name voiceprints or voice data anywhere in this definition. Article 11 forbids processing sensitive personal data under item 3 of Article 3 unless one of the lawful bases in Article 9 of the Act is met together with one of the further conditions listed in Article 11, set out in more detail in Article 9 of Regulation (EU) 2016/679, the first of which is the data subject's explicit consent.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .