LuxembourgGDPR Article 9, Special Categories of Personal Data as Applied in Luxembourg
Regulation (EU) 2016/679, Art. 9
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Ground the processing of any biometric identifier of a person in Luxembourg, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent.
These lines are LexLint's reading of the law's text. Also read by: Commission nationale pour la protection des données (CNPD) (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://cnpd.public.lu/en/professionnels/obligations/liceite/donnees-sensibles.html
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber)
- Guidance body
- Commission nationale pour la protection des données (CNPD)
- Open questions
- Does processing that serves journalism or academic, artistic or literary expression alongside a commercial purpose count as processing carried out 'for the sole purpose' of that expression under Article 62 of the Act of , so that it escapes the Article 9(1) prohibition on special categories of data?
- Does a controller that derives a faceprint or voiceprint from a publicly available image or recording, but does not use it 'for the purpose of uniquely identifying a natural person', process special categories of data under Article 9(1), as paragraph 75 of the Board's video guidelines frames the test?
What it makes you log
Logging duty
Article 9(1) prohibits processing special categories of data, including biometric data used to identify a person, and Article 9(2) lists the exceptions. Neither states a duty to create, keep or produce a log or record. Article 66 of the Act of prohibits processing genetic data for labour-law and insurance rights and names no record.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. The Act of has a chapter headed "Processing of special categories of personal data" that consists of one article, which prohibits processing genetic data for the controller's rights in labour law and insurance (Article 66). A voiceprint or faceprint captured for identification purposes is therefore governed in Luxembourg by GDPR Article 9 alone.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .