Law note · Malta
GDPR Article 9 and Cap. 586, Genetic, Biometric and Health Data Research Processing in Malta
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category.
Two independent secondary sources (Linklaters, Mondaq) converge on the same finding: a controller must consult with, and obtain prior authorization from, the IDPC before processing genetic, biometric, or health data for statistical or research purposes in the public interest, and the IDPC must in turn consult an ethics committee or an IDPC-recognised institution for the same category of processing.
This duty is scoped to statistical, research, and public-interest processing; a commercial product capturing voiceprints or faceprints for authentication or identification outside a research context is governed by GDPR Article 9 alone, with no Malta-specific addition identified for that use case. The provision's exact article number was not independently confirmed against Cap. 586's own text this pass.
What it asks of an app
- Consult with, and obtain prior authorization from, the IDPC before processing genetic, biometric, or health data of a person in Malta for statistical or research purposes in the public interest, under Cap. 586.
- Ground the processing of any biometric identifier captured for commercial authentication or identification purposes on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent; Cap. 586's research-specific duty does not reach this use case.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: Two independent secondary sources (Linklaters, Mondaq), not independently confirmed against Cap. 586's own text this pass