SlovakiaGDPR Article 9 and Act Section 78, National Birth Number
Regulation (EU) 2016/679, Art. 9; Zakon c. 18/2018 Z. z., section 78
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Obtain an explicit General Data Protection Regulation (GDPR) Article 9(2) legal basis before processing biometric, genetic, or health data of a person in Slovakia.
- Use the Slovak birth number (rodne cislo) to identify a person only where that use is necessary for the purpose, obtain explicit consent where consent is the legal basis, and do not publish it unless the data subject published it themself (Act No. 18/2018 Coll., Section 78(4)).
These lines are LexLint's reading of the law's text. Also read by: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://dataprotection.gov.sk/files/metod-urad/6/zakonnost_aktualizovana_verzia_22-01-2019.pdf
- Guidance body
- Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic)
- Open questions
- Does a special regulation or international agreement named in Section 78(5) of Act No. 18/2018 replace a condition under Article 9(2) of the GDPR for processing genetic, biometric or health data, or does it only supply the legal basis under Article 6(1)?
What it makes you log
Logging duty
Article 9 and sections 16 and 78 of Act No. 18/2018 Coll. set when special categories of data and the generally usable identifier (the birth number) may be processed. They state no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category. Section 16(1) of Act No. 18/2018 Coll. restates the prohibition on processing special categories of personal data, which include biometric data. Section 78(5) lets a controller process genetic, biometric and health data on the legal basis of a special regulation or an international agreement that binds Slovakia, a general enabling clause rather than a biometric-specific rule.
Section 78(4) allows the generally usable identifier to be used to identify a person only where that use is necessary for the purpose, requires consent to its processing to be explicit, and prohibits publishing it unless the data subject publishes it themself. The special regulation that the generally usable identifier points to is Act 301/1995 Coll. on the birth number (rodne cislo).
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .