Bosnia and HerzegovinaLaw on the Protection of Personal Data of Bosnia and Herzegovina, biometric data processing
Law on the Protection of Personal Data, arts. 57a-57b (biometric data processing)
In force since .
A biometric privacy rule binding public and private bodies.
- Obligation class
- Biometric, Consent
- Audit expectation
- none
What it requires
- Obtain the person's explicit consent before processing a biometric identifier for the individual secure identification of a service user, and only where the processing is otherwise required by law or necessary to protect a person, property, classified information, or a trade secret, and the person's conflicting interests do not prevail, under Article 57a.
- Obtain an employee's explicit consent before processing their biometric data to record working time or to control entry to and exit from official premises, and offer it only where required by law or as an alternative to another recording or access method, under Article 57b.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 57a and 57b permit biometric processing for secure identification and for an employee's working-time or entry control only on a legal requirement or the person's explicit consent. Neither asks for a log or record. The use records of a video surveillance system are in Article 57(6), which this row excludes.
- Kind
- None
- As of
What this law does
Article 57a permits processing biometric data only where required by law or necessary to protect a person, property, classified information or a trade secret, or for the individual secure identification of a service user, provided the person's conflicting interest does not prevail, and Article 57a(2) makes the person's explicit consent the legal basis for processing their biometric data for secure identification.
Article 57b permits processing an employee's biometric data to record working time or to control entry to and exit from official premises only where required by law or offered as an alternative to another recording or access method, and only with the employee's explicit consent.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .