ArmeniaLaw on Protection of Personal Data, biometric data provisions
In force since .
A biometric privacy rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that captures or stores a voiceprint, faceprint, or other biometric identifier from a person in Armenia must obtain the data subject's consent, unless a law-defined purpose can only be achieved through that processing, and must notify the authorized body before beginning to process biometric data, since Armenia's biometric-data definition does not distinguish by modality or by whether the identifier was derived from a recording.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the condition in Article 13(1) that the purpose pursued by law "հնարավոր է իրականացնել միայն այդ կենսաչափական տվյալները մշակելու միջոցով" ("can be achieved only by processing that biometric data") apply to biometric processing with the data subject's consent as well as to the cases the law provides for?
- Which information must the notice that Article 23(3) requires before biometric or special category data is processed contain, given that Article 23(4) lists the contents of the notice while Article 23(5), (7) and (8) refer to information "սույն հոդվածի 2-րդ մասով նախատեսված" ("provided for in part 2 of this Article")?
What it makes you log
Logging duty
Article 13 makes consent the default basis for biometric data, Article 19(6) requires material carriers and technologies that protect biometric data held outside information systems, and Article 23(3) requires the processor to notify the authorized body of its intent before processing biometric or special category data. That notification is a filing the authority enters in its own register of processors under Article 23(5), not a record the processor keeps, and no cited section requires a log. The authority's checking powers are in Articles 19(8) and 24, which are not among the sections this row cites.
- Kind
- None
- As of
What this law does
Art. 3(13) defines biometric personal data only as information characterizing a person's physical, physiological and biological characteristics, a bare, generic definition with no processing-method qualifier, no unique-identification qualifier, and no named modality such as voice or face.
Art. 13 requires the data subject's consent as the default basis for processing biometric data, except where a law-defined purpose can only be achieved through that processing; no modality-specific variation exists.
Art. 19(6) allows biometric data outside information systems to be used and kept only on material carriers, with technologies or in forms that protect it from unauthorized access, unlawful use, destruction, alteration, blocking, copying, and distribution, and leaves the requirements for those carriers and storage technologies to the autonomous body provided for by the Law on Public Information.
Art. 23(3) additionally requires the processor to notify the authorized body before processing biometric or special-category data of its intent to do so, a pre-processing notification duty. Because the Art. 3(13) definition has no derivation or identification qualifier at all, whether it includes or excludes an identifier derived from a photo, video, or audio recording is not addressed by the statute's text.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .