Duty LXD-1382
Processes biometric data, in Russia
Federal Law No. 152-FZ, Articles 10-11, Special Categories and the Biometric Data Definitionsince 2 lines
Federal Law No. 152-FZ, Art. 10-11 · Read the law's page
- Obtain written consent before processing biometric personal data of a person in Russia, including an identifier such as a facial image or voice recording that would fall under Article 11's general definition, unless a narrow Article 11(2) statutory exception applies.
- Never make provision of biometric data a condition of service to a person in Russia, except where a separate federal law affirmatively mandates identification.
Federal Law No. 572-FZ, Unified Biometric System for Identification and Authenticationsince 2 lines
Federal Law No. 572-FZ of "On the identification and/or authentication of individuals using biometric personal data" · Read the law's page
- Route biometric identification, matching an unknown person against a database, of a person in Russia only through the state Unified Biometric System; a private accredited system may only perform authentication, using derived mathematical vectors rather than the original template, and may not transmit those vectors to a third party.
- Obtain written consent before processing a person's biometric data in Russia, never condition service on that consent, and retain any biometric sample your organization holds only up to 10 days before deleting it, since the durable copy of record lives in the state system.
Criminal Code Article 272.1, Illegal Collection, Storage, Use, or Transfer of Personal Datasince 1 line
Criminal Code of the Russian Federation, Art. 272.1, added by Federal Law No. 421-FZ, in force · Read the law's page
- Expect criminal liability for an individual involved in illegally collecting, storing, using, or transferring personal data of a person in Russia, rising to up to 8 years for an unauthorized cross-border transfer and up to 10 years for an organized group or grave consequences, under Criminal Code Article 272.1.