Processes biometric data, in Bosnia and Herzegovina

Law on the Protection of Personal Data, arts. 10-12 (special categories, criminal-conviction data and children's consent) · Read the law's page

• Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union affiliation, genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception in Article 11 applies, such as the person's explicit consent.
• Process personal data about a criminal conviction or offence only under the supervision of a public authority or where a special law authorizes it with safeguards for the person's rights, and keep any register of criminal convictions exclusively under a public authority's control, under Article 12.
• Treat a child's consent to an information-society service offered directly to them as lawful only from age 16, and below that age obtain or verify the consent of a parent, adoptive parent, or guardian, making reasonable efforts to confirm it given available technology, under Article 10.

Law on the Protection of Personal Data, arts. 57a-57b (biometric data processing) · Read the law's page

• Obtain the person's explicit consent before processing a biometric identifier for the individual secure identification of a service user, and only where the processing is otherwise required by law or necessary to protect a person, property, classified information, or a trade secret, and the person's conflicting interests do not prevail, under Article 57a.
• Obtain an employee's explicit consent before processing their biometric data to record working time or to control entry to and exit from official premises, and offer it only where required by law or as an alternative to another recording or access method, under Article 57b.