Law note · Lithuania
GDPR Article 9, Special Categories of Personal Data as Applied in Lithuania
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. No Lithuanian statutory enumeration, illustrative list, or VDAI guidance document text on biometric identifiers, faceprints, or voiceprints was read directly this pass.
Secondary commentary (Linklaters) describes VDAI as having issued an order naming processing of telephone-conversation recordings and use of biometric data among the situations requiring a data protection impact assessment; the order itself was not read, so its content is not restated here beyond this general description.
What it asks of an app
- Ground the processing of any biometric identifier of a person in Lithuania, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent.
- Conduct a data protection impact assessment before processing biometric data or telephone-conversation recordings of a person in Lithuania, per VDAI guidance describing these as triggering situations.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679