Glossary
Special category data (GDPR)
Special category data is the group of personal data that Article 9 of the GDPR bans organizations from processing unless a listed exception applies. It includes health data and biometric data used to identify a person, and a voice recording can fall into it when it is processed that way.
Updated October 17, 20263 cited facts, each traced to its source
Also called sensitive personal data, Article 9 data.
Special category data is the group of personal data that the EU's General Data Protection Regulation (GDPR) protects most strictly. Under Article 9, an organization may not process this kind of data unless one of the listed exceptions applies. The list names genetic data, biometric data used to identify a person, data concerning health, and data about a person's sex life or sexual orientation 1.
A voice recording becomes special category data when it identifies someone
A voice recording is not special category data just because it contains a voice. It becomes biometric data when it is processed to identify someone. The GDPR defines biometric data as personal data from specific technical processing of physical, physiological or behavioural characteristics, where that processing allows or confirms the unique identification of a person 2. A voiceprint used to recognize a speaker is the clearest case.
The GDPR's recital on photographs shows how the test works. A photograph counts as biometric data only when it is processed through specific technical means that allow unique identification or authentication 3. The definition in Article 4 does not name voice, so the same test applies to audio: the purpose and the processing decide the category.
A concrete example: a dictated clinical note
A doctor dictates a patient's diagnosis into a dictation tool. The words describe the patient's health, so the note holds data concerning health, which Article 9 lists as special category data 1. The software turned sound into text, but the category depends on what the text says about a person.
If the same tool also builds a voice profile to confirm who is speaking, that profile may be biometric data used for identification. Then the tool processes two kinds of special category data at once: the health content and the voice template.
Why it matters for dictation
Dictation is one of the easiest ways to create special category data without noticing. People dictate medical histories, therapy notes, diary entries and messages about their health. Each of these can fall under Article 9 once it is stored by an organization that is subject to the GDPR.
Three questions help you judge a dictation product. Does it store audio or transcripts on a server? Does it use a voice profile to identify the speaker? Does its privacy policy name the exception it relies on for health content? A tool that processes speech on the device answers the first question with no, which removes one route for the data to leave your control. It does not answer the other two.
This page describes what the regulation says. It is not legal advice, and the outcome for any one organization depends on its role and its legal basis. In the United States, the closest parallel for health information is protected health information (PHI), which follows a different law.
Related terms
- Biometric data: the GDPR category that a voice becomes when it identifies a person.
- Voiceprint: a voice template used to recognize a speaker.
- Speaker verification: checking a claimed identity by voice, which can make a voice biometric.
- On-device speech recognition: recognition that runs on the device, so audio does not have to leave it.
Guides that cover it
Evidence
Every number on this page, with where it comes from. Open a fact to see the exact words in its source.
- 1.
- 2.
- 3.
Related terms
- Speech to Text Privacy: Where Your Voice GoesThe topic this term belongs to
- All-party consentAll-party consent is a recording rule under which every participant in a conversation must agree before it can be recorded or intercepted. California, Florida and Maryland use it in their statutes, and it is stricter than one-party consent.
- Attorney-client privilegeAttorney-client privilege protects confidential communications between a lawyer and their client about seeking legal advice or services. A third party who is present, or a tool that handles the conversation, can put that protection at risk.
- Biometric dataBiometric data is personal data produced by technical processing of a person's physical, physiological or behavioral characteristics that allows or confirms who that person is. A voice recording becomes biometric data when it is processed to identify the speaker.
- Business associate agreement (BAA)A business associate agreement (BAA) is the written contract that HIPAA requires before a covered entity lets a vendor create, receive, maintain or transmit protected health information on its behalf. Dictation tools used in clinics often need one, and a BAA alone does not make a product compliant.
- False accept (accidental activation)A false accept, also called a false wake or accidental activation, is when a voice assistant or dictation feature starts listening or recording although the wake word was not said. Smart speakers have been measured to wake by accident, and that can capture speech the user did not mean to share.
- Federated learningFederated learning is a way to train one machine learning model on data spread across many devices. Each device computes an update from its own data, and only those updates are sent to a server, so the raw data does not have to be collected in one place.
- On-device speech recognitionOn-device speech recognition converts speech to text with a model that runs on your own computer or phone, so the audio does not need to be sent to a server. It is also called local, offline or on-device dictation.
- One-party consentOne-party consent is a recording rule under which a conversation can be recorded lawfully when one of its participants agrees, which is usually the person doing the recording. The US federal wiretap law uses this rule, and individual states may set stricter ones.
- Protected health information (PHI)Protected health information (PHI) is individually identifiable health information that HIPAA protects when it is held or sent in electronic or other form by a covered entity or its business associate. Patient names with diagnoses, in dictated notes or voice recordings, are PHI. It is also called ePHI when held electronically.
- Speaker verificationSpeaker verification is a voice biometric check in which a system accepts or rejects a claimed identity by comparing a voice with stored models of the person claimed. It is also called voice authentication, voice ID or voice biometrics.
- Voice cloningVoice cloning is the use of a model trained on recordings of one person to generate new speech in that person's voice. Some products need only minutes of clear audio, and cloned voices have been used in fraud, so recordings of your voice carry a real risk.
- VoiceprintA voiceprint is a stored model of a person's voice, built from measurable features of their speech and used to recognize or verify that person. Illinois law lists voiceprints among biometric identifiers, and other vendors call the same idea a voice template or speaker model.