Law note · Cyprus
GDPR Article 9 and Law 125(I)/2018, Genetic and Biometric Data in Cyprus
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Secondary commentary (Harris Kyriakides) describes Law 125(I)/2018 as prohibiting the processing of genetic and biometric data for life and health insurance purposes, and as requiring separate, specific consent, over and above the ordinary GDPR consent standard, where a controller relies on consent as the lawful basis for processing genetic or biometric data.
The provision's own text and article number were not independently confirmed this pass; neither addition distinguishes voice or face capture from any other biometric modality in the commentary consulted. No Cyprus-specific voiceprint or faceprint case or regulatory guidance was located.
What it asks of an app
- Do not process genetic or biometric data of a person in Cyprus for life or health insurance purposes, per Law 125(I)/2018's insurance prohibition.
- Obtain separate, specific consent, over and above the ordinary General Data Protection Regulation (GDPR) consent standard, before relying on consent as the lawful basis for processing genetic or biometric data of a person in Cyprus.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: Secondary commentary (Harris Kyriakides), not independently confirmed against Law 125(I)/2018's own text this pass