Law note · Belgium
Act of 30 July 2018 Articles 8-10, Special-Category Processing Grounds
General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category. Article 9 of the Act, read verbatim, requires every controller processing genetic, biometric, or health data to designate the categories of staff with access, keep that list available to the supervisory authority, and bind those staff to confidentiality.
Article 8, paragraph 1's final subparagraph outright prohibits genetic and biometric processing for unique identification by the specific associations and foundations it authorizes under Article 9(2)(g), absent particular legal provisions. Article 10, paragraph 1, point 6 makes processing of criminal-conviction data manifestly made public by the data subject a lawful-basis ground, not a scope exclusion.
What it asks of an app
- Designate the specific staff with access to genetic, biometric, or health data of a person in Belgium, keep that list available to the GBA/APD, and bind those staff to confidentiality, per Act Article 9.
- Do not treat a photo, video, or audio recording as processable merely because it is public; Belgium's own lawful-basis ground for manifestly public data is keyed to an affirmative act by the data subject, not a scope exclusion.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, trains_models
Primary source: Moniteur belge, 5 September 2018, Arts. 8-10 (direct read, verbatim)