MaltaGDPR Article 9 and Cap. 586, Genetic, Biometric and Health Data Research Processing in Malta
Regulation (EU) 2016/679, Art. 9; Data Protection Act, Cap. 586
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 May 2018.
A biometric privacy rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Consult with, and obtain prior authorization from, the IDPC before processing genetic, biometric, or health data of a person in Malta for statistical or research purposes in the public interest, under Cap. 586.
- Ground the processing of any biometric identifier captured for commercial authentication or identification purposes on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent; Cap. 586's research-specific duty does not reach this use case.
What it reaches
Excludes recording-derived identifiersNo
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category.
Confirmed directly against Cap. 586's own text during the #8352 wave 4 review (Article 7, Consultation and prior authorisation): a controller must consult with, and obtain prior authorisation from, the Commissioner before processing genetic data, biometric data, or data concerning health for statistical or research purposes in the public interest, and where such data is required for research purposes the Commissioner must in turn consult a research ethics committee or an institution the Commissioner recognises for that purpose.
Two independent secondary sources (Linklaters, Mondaq) had already reported the same finding, but the document previously stated Cap. 586's own PDF did not yield extractable text; that PDF is in fact readable, and this article-level detail is confirmed against it directly.
This duty is scoped to statistical, research, and public-interest processing; a commercial product capturing voiceprints or faceprints for authentication or identification outside a research context is governed by GDPR Article 9 alone, with no Malta-specific addition identified for that use case.
When LexLint raises it
processes_biometricsprocesses_voice
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.