Law note · Finland
GDPR Article 9 and Data Protection Act Section 6, Special Categories in Finland
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category.
Data Protection Act Section 6, read in full, lifts the Article 9(1) bar in eight named contexts (insurance claims, statutory duty, trade union membership for employment law, healthcare and social welfare delivery, anti-doping and disability sports, and research, statistics or archiving); none of the eight names biometric data, and the section carries no illustrative list or enumeration of biometric identifier types.
Biometric data processed for unique identification is therefore governed directly by GDPR Article 9 itself, with no Finland-specific narrowing or widening of the definition found.
What it asks of an app
- Ground the processing of any biometric identifier of a person in Finland, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent, unless it falls within one of the eight contexts Data Protection Act Section 6 lists, none of which is biometric-specific.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: Ministry of Justice, Finland, official English translation, Data Protection Act Section 6