Processes biometric data, in Bhutan

Information, Communications and Media Act of Bhutan 2018, definitions clause, item 89(f) · Read the law's page

• An app that derives a voiceprint, faceprint, or other biometric identifier from a person in Bhutan must treat it as Sensitive Personal Data or Information and obtain the subject's express written permission before collecting it, unless the information is itself freely available or accessible in the public domain.

Information, Communications and Media Act of Bhutan 2018, ss.336-337, 339-343, 384-386 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Bhutan, including a voiceprint, faceprint, or other biometric identifier, must obtain the subject's express written permission before collecting it and must not disclose it to a third party without authorization. An ICT or media service provider or vendor must additionally publish a privacy policy, limit collection and use to what is reasonably appropriate, store and use data only for its intended purpose, and remain responsible for data it transfers to a third party.

Information, Communications and Media Act of Bhutan 2018, ss.338(3), 340 · Read the law's page

• An ICT or media service provider or vendor in Bhutan must include in its privacy policy details on how users or consumers may review and, when necessary, have their information, including a biometric identifier, amended or removed, and must allow the information collected to be removed or withdrawn upon the user's request.

Information, Communications and Media Act of Bhutan 2018, ss.387-388 · Read the law's page

• An app that negligently fails to implement reasonable security practices for personal data of a person in Bhutan, including a biometric identifier, and thereby causes wrongful loss or gain, is liable to pay court-determined compensation to the victim, and unlawfully disclosing another's personal data without consent is a separate offence under section 388.

National Digital Identity Act of Bhutan 2023 (NDI Act 2023)

• Limit collection and use of digital identity data to what is necessary for the stated purpose.