Law note · Austria
GDPR Article 9, Special Categories of Personal Data Including Biometric Data, as Applied in Austria
Article 9(1) prohibits processing special categories of personal data, including biometric data processed to uniquely identify a person, unless a listed Article 9(2) exception applies, most often explicit consent. Austria adds no separate statutory biometric regime alongside General Data Protection Regulation (GDPR) Article 9. The Datenschutzbehorde found in 2021 that Clearview AI's scraped facial recognition database was unlawful under Austrian data protection law for processing biometric data without a lawful basis.
No Austria-specific guidance on voiceprint biometrics specifically was found in this research; the GDPR baseline, that a voiceprint captured through specific technical processing for identification is special category data on the same footing as a faceprint, governs by default.
What it asks of an app
- Obtain explicit consent, or establish another General Data Protection Regulation (GDPR) Article 9(2) basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
- Treat any biometric identifier your system derives through its own technical processing as special category data under Austrian and EU law alike, even where the underlying image or audio was lawfully public.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, high_risk_decisions
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679
DSB Clearview AI decision (2021)