Law note · Estonia
GDPR Article 9, Special Categories of Personal Data as Applied in Estonia
cite Regulation (EU) 2016/679, Art. 9
stage In effect
since 2019-01-15
reviewed 2026-08-24
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. No Estonian statutory enumeration or illustrative list narrowing or expanding this definition was read this pass, and none is asserted; the Personal Data Protection Act's own text did not extract through crawler infrastructure, and the Estonian Data Protection Inspectorate's thematic-inspection page returned no usable content. No AKI guidance or enforcement decision naming facial recognition or voice data specifically was located.
What it asks of an app
- Ground the processing of any biometric identifier of a person in Estonia, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679