Processes biometric data, in Kosovo

Law No. 06/L-082 on Protection of Personal Data, arts. 7-9 (special categories, children and criminal-offence data) · Read the law's page

• Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 8(2) exception applies, most commonly the data subject's explicit consent.
• Where you rely on an Article 8(2) exception, protect special categories of personal data with heightened, classified safeguards against unauthorised access and use.
• Confine any processing of personal data about a person's criminal convictions or offences, or related security measures, to what an official authority controls under the relevant law.
• Treat sixteen as the age at which a child may consent to an information-society service directly, and obtain or verify consent or authorisation from a parent or holder of parental responsibility below that age, making reasonable and ongoing efforts, using available technology, to confirm that consent when the child is between fourteen and sixteen.
• Treat an identifier your system derives from a photograph or video of a person in Kosovo, such as a faceprint, as covered biometric data under Article 3(1)(20); the definition names visual images and fingerprint, iris, retina, facial-feature and DNA data as examples and excludes nothing that is recording-derived.

Law No. 06/L-082 on Protection of Personal Data, arts. 80-83 (use of biometric characteristics) · Read the law's page

• Before determining, using or comparing a data subject's biometric characteristics to identify them, confirm this chapter's dedicated rules apply rather than the law's general processing rules alone.
• In the public sector, use biometric characteristics only where strictly necessary for the safety of individuals, the protection of property, or safeguarding confidential data and trade secrets, and only where no easier means would achieve that purpose.when it serves a public body
• In the private sector, apply the same necessity test, inform employees in writing in advance of the measures and their rights, and submit a detailed description of the proposed measures to the Agency for Information and Privacy before taking them.
• Do not implement a private-sector biometric measure until the Agency has authorised it, which the Agency must decide within thirty days of receiving your submission.
• Where biometric characteristics are used for access control in the public sector, apply the entry and exit records chapter's retention and handling safeguards to that use.when it serves a public body