Law note · Iceland
Act No. 90/2018 Articles 3(14) and 9, Special Categories in Iceland
Act No. 90/2018 Article 3, item 14, read directly, defines biometric data as personal data obtained through specific technical processing relating to a person's physical, physiological or behavioural characteristics that allow or confirm unique identification, and gives facial images and fingerprint data as illustrative examples using a non-exhaustive such as construction. It does not name voiceprints or voice data anywhere in this definition.
Article 9 prohibits processing biometric data for the purpose of uniquely identifying a natural person absent an Article 9(2)-style exception such as explicit consent, mirroring General Data Protection Regulation (GDPR) Article 9 with no Iceland-specific narrowing or widening found.
What it asks of an app
- Ground the processing of any biometric identifier of a person in Iceland, including a faceprint captured for unique identification, on an Article 9(2)-style exception such as explicit consent, under Act No. 90/2018 Article 9.
- Do not assume voice capture is excluded from Article 3(14)'s biometric-data definition merely because the Act's illustrative examples name only facial images and fingerprint data; the definition's own operative test is specific technical processing for unique identification, not the modality named as an example.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: Althingi official consolidated-law database, fetched and read directly, Articles 3(14) and 9