LatviaPersonal Data Processing Law Article 25(2), Special Categories in Latvia
Fizisko personu datu apstrades likums, Art. 25(2); Regulation (EU) 2016/679, Art. 9
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Ground the processing of any biometric identifier of a person in Latvia, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent, under Personal Data Processing Law Article 25(2).
These lines are LexLint's reading of the law's text. Also read by: European Data Protection Board (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201903_video_devices_en_0.pdf
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber)
- Guidance body
- European Data Protection Board
- Open questions
- Which 'extērnā normītvā aktā' (external normative act) under Article 25(2) of the Personal Data Processing Law provides for the processing of special categories of data, as GDPR Article 9(4) allows, and does it reach biometric data?
- Does a controller that derives a faceprint or voiceprint from a publicly available image or recording, but does not use it 'for the purpose of uniquely identifying a natural person', process special categories of data under Article 9(1), as paragraph 75 of the Board's video guidelines frames the test?
What it makes you log
Logging duty
Article 25(2) allows processing special-category data on a ground in GDPR Article 9(2), or where another normative act provides for it under Article 9(4), and states no duty to create, keep or produce a log or record. The data protection impact assessment the row mentions rests on GDPR Article 35, which this row does not cite.
- Kind
- None
- As of
What this law does
Article 25(2) of the Personal Data Processing Law, confirmed at likumi.lv, restates General Data Protection Regulation (GDPR) Article 9's special-category list and its own biometric-data term mirroring GDPR Article 4(14)'s definition (processing necessary for unique identification). It carries no illustrative list, enumeration, or named example distinguishing facial recognition from voice data or any other biometric modality.
It permits the processing on a ground in GDPR Article 9(2), or where another normative act provides for it under GDPR Article 9(4), and does not narrow or widen the biometric category.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .