Processes personal data, in Bhutan

Information, Communications and Media Act of Bhutan 2018, definitions clause, item 89(f) · Read the law's page

• An app that derives a voiceprint, faceprint, or other biometric identifier from a person in Bhutan must treat it as Sensitive Personal Data or Information and obtain the subject's express written permission before collecting it, unless the information is itself freely available or accessible in the public domain.

Information, Communications and Media Act of Bhutan 2018, ss.336-337, 339-343, 384-386 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Bhutan, including a voiceprint, faceprint, or other biometric identifier, must obtain the subject's express written permission before collecting it and must not disclose it to a third party without authorization. An ICT or media service provider or vendor must additionally publish a privacy policy, limit collection and use to what is reasonably appropriate, store and use data only for its intended purpose, and remain responsible for data it transfers to a third party.

Information, Communications and Media Act of Bhutan 2018, ss.338(3), 340 · Read the law's page

• An ICT or media service provider or vendor in Bhutan must include in its privacy policy details on how users or consumers may review and, when necessary, have their information, including a biometric identifier, amended or removed, and must allow the information collected to be removed or withdrawn upon the user's request.

Information, Communications and Media Act of Bhutan 2018, ss.387-388 · Read the law's page

• An app that negligently fails to implement reasonable security practices for personal data of a person in Bhutan, including a biometric identifier, and thereby causes wrongful loss or gain, is liable to pay court-determined compensation to the victim, and unlawfully disclosing another's personal data without consent is a separate offence under section 388.

Cybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under Information, Communications and Media Act of Bhutan 2018, s.58), s.8.6 · Read the law's page

• A Telecom Service Provider or other ICT service provider with critical information infrastructure in Bhutan must establish and communicate a privacy and PII-protection policy, implement procedures to preserve that privacy, including for a biometric identifier such as a voiceprint or faceprint handled as PII, and put in place appropriate technical and organizational measures, consistent with its reporting obligations under the Information, Communications and Media Act of Bhutan 2018.