LiechtensteinDSG Special Categories of Personal Data, GDPR Article 9 and DSG Article 21 in Liechtenstein
Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, Article 21
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Ground the processing of any biometric identifier of a person in Liechtenstein, including a faceprint or voiceprint captured for unique identification, on a ground in General Data Protection Regulation (GDPR) Article 9(2), such as explicit consent, or on a derogation in Article 21 of the Datenschutzgesetz.
These lines are LexLint's reading of the law's text. Also read by: Datenschutzstelle (Data Protection Authority) of the Principality of Liechtenstein (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.datenschutzstelle.li/rechtsgrundlagen/glossar-zur-dsgvo
- Guidance body
- Datenschutzstelle (Data Protection Authority) of the Principality of Liechtenstein
- Open questions
- Does a controller that derives a faceprint or voiceprint from a publicly available image or recording, but does not use it "for the purpose of uniquely identifying a natural person", process special categories of data under Article 9(1) of Regulation (EU) 2016/679?
What it makes you log
Logging duty
Article 21(2) requires adequate and specific measures to safeguard the data subject where Article 21(1) is relied on. Its list of what those measures may include names, at point (b), measures that make it possible to check afterwards whether and by whom personal data were entered, changed or removed, but the list is introduced by 'können dazu insbesondere gehören' (may in particular include), so a log is one example the controller may choose and the clause requires no record. Article 21 has no scope clause of its own and invokes none, so no territorial hook is coded.
- Kind
- None
- As of
What this law does
Article 9(1) of the General Data Protection Regulation (GDPR) prohibits the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
Article 21(1) of the Datenschutzgesetz permits, as a derogation from Article 9(1) of the GDPR, the processing of special categories of personal data in listed cases. That includes processing by public and non-public bodies where it is necessary to exercise rights and meet duties under social security and social protection law. Where it relies on Article 21(1), Article 21(2) requires adequate and specific measures to safeguard the interests of the data subject.
The Datenschutzstelle's own published glossary lists voice patterns and face patterns among biometric data, which it describes as unique and lasting. The glossary adds that photographs count as biometric data only when processed with special technical means that allow unique identification or authentication of a person.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .