MaltaGDPR Article 9 and Cap. 586, Genetic, Biometric and Health Data Research Processing in Malta
Regulation (EU) 2016/679, Art. 9; Data Protection Act, Cap. 586
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Consult with, and obtain prior authorization from, the IDPC before processing genetic, biometric, or health data of a person in Malta for statistical or research purposes in the public interest, under Cap. 586.NIST Privacy FrameworkGV.PO-P5
- Ground the processing of any biometric identifier captured for commercial authentication or identification purposes on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent; Cap. 586's research-specific duty does not reach this use case.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: European Data Protection Board (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201903_video_devices_en_0.pdf
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber)
- Guidance body
- European Data Protection Board
- Open questions
- Does Article 7 of Cap. 586, which requires consultation with and prior authorisation from the Commissioner for genetic, biometric or health data processed 'in the public interest' for statistical or research purposes, reach a commercial controller whose research purpose is not in the public interest?
- Does a controller that derives a faceprint or voiceprint from a publicly available image or recording, but does not use it 'for the purpose of uniquely identifying a natural person', process special categories of data under Article 9(1), as paragraph 75 of the Board's video guidelines frames the test?
What it makes you log
Logging duty
Article 7 makes a controller consult the Commissioner and obtain prior authorisation before processing genetic, biometric or health data in the public interest for statistical or research purposes. That is a permission step and states no duty to create, keep or produce a log or record. GDPR Article 9 is a prohibition with exceptions and sets no record duty of its own.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category.
Under Cap. 586's Article 7 (Consultation and prior authorisation), a controller must consult with, and obtain prior authorisation from, the Commissioner before processing genetic data, biometric data, or data concerning health for statistical or research purposes in the public interest, and where such data is required for research purposes the Commissioner must in turn consult a research ethics committee or an institution the Commissioner recognises for that purpose.
This duty is scoped to processing in the public interest for statistical or research purposes, so a commercial product capturing voiceprints or faceprints for authentication or identification outside a research context falls outside Article 7.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .