LithuaniaGDPR Article 9, Special Categories of Personal Data as Applied in Lithuania
Regulation (EU) 2016/679, Art. 9
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Ground the processing of any biometric identifier of a person in Lithuania, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent.NIST Privacy FrameworkCT.PO-P1
- Conduct a data protection impact assessment before processing special categories of personal data, including biometric data, of persons in Lithuania on a large scale, under GDPR Article 35(3)(b).NIST Privacy FrameworkID.RA-P4
These lines are LexLint's reading of the law's text. Also read by: Case C-184/20 OT v Vyriausioji tarnybinės etikos komisija, judgment of the Court of Justice of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0184
- Case citation
- Case C-184/20 OT v Vyriausioji tarnybinės etikos komisija, judgment of the Court of Justice of (Grand Chamber)
- Open questions
- Which data that only indirectly reveal a special category, beyond the name of a spouse or partner in a declaration of private interests as in Case C-184/20, are special categories of personal data under Article 9(1) of Regulation (EU) 2016/679?
What it makes you log
Logging duty
GDPR Article 9 prohibits processing special categories of data, subject to the exceptions in Article 9(2), and states no duty to create, keep or produce a log or record. Article 5(4) of the Law on Legal Protection of Personal Data separately requires an employer that monitors employees to inform them in writing or in another way that proves they were informed; that article is outside the provisions cited for this row.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Article 5(4) of the Law on Legal Protection of Personal Data requires an employer that processes video or audio data at the workplace, or data on employees' conduct, location or movement, to inform the employees by signature or in another way that proves they were informed, giving the information listed in GDPR Article 13(1) and (2).
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .