Law note · Luxembourg
GDPR Article 9, Special Categories of Personal Data as Applied in Luxembourg
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Unlike every other jurisdiction in this batch, Luxembourg was searched specifically for a biometric-specific national derogation and none was found: a CMS Expert Guide entry states directly that no specific provisions regarding biometrics are envisaged in the Act of 1 August 2018, and that the general GDPR framework applies without a national addition.
A voiceprint or faceprint captured for identification purposes is therefore governed in Luxembourg by GDPR Article 9 alone. No Luxembourg-specific voiceprint case or regulatory guidance was located.
What it asks of an app
- Ground the processing of any biometric identifier of a person in Luxembourg, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent; no Luxembourg-specific addition to this baseline was found.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: CMS Expert Guide to Data Protection and Cyber Security Laws, Luxembourg entry, fetched and read directly