PortugalGDPR Article 9, Special Categories of Personal Data as Applied in Portugal
Regulation (EU) 2016/679, Art. 9
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Ground the processing of any biometric identifier of a person in Portugal, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent.NIST Privacy FrameworkCT.PO-P1
- Process the biometric data of a worker in Portugal only for attendance control and for control of access to your premises, use only representations of the biometric data, and collect it in a way that does not allow the data to be reversed, under Lei 58/2019 Article 28(6).NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.DP-P2
These lines are LexLint's reading of the law's text. Also read by: European Data Protection Board (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DP-P2Data are processed to limit the identification of individuals (e.g., de-identification privacy techniques, tokenization).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201903_video_devices_en_0.pdf
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber)
- Guidance body
- European Data Protection Board
- Open questions
- Does Article 28(6) of Lei 58/2019, which makes the processing of workers' biometric data legitimate 'só' (only) for attendance control and for control of access to the employer's premises, bar a worker's explicit consent under GDPR Article 9(2)(a) as a basis for any other use of biometric data?
- Does a controller that derives a faceprint or voiceprint from a publicly available image or recording, but does not use it 'for the purpose of uniquely identifying a natural person', process special categories of data under Article 9(1), as paragraph 75 of the Board's video guidelines frames the test?
What it makes you log
Logging duty
Article 9(1) prohibits processing of special categories of data, including biometric data used to identify a person, and Lei 58/2019 Article 28(6) limits workers' biometric processing to attendance and access control with irreversible representations. Neither states a duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Article 28(6) of Lei 58/2019 treats the processing of employees' biometric data as legitimate only for attendance control and for control of access to the employer's premises, and requires that only representations of the biometric data are used and that the collection process does not allow the data to be reversed.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .