GeorgiaLaw on Personal Data Protection, biometric data article
Law of Georgia on Personal Data Protection, Law No. 3144-XI, Art. 9; Art. 3(d)
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that captures or stores a facial image, voiceprint, or other biometric identifier from a person in Georgia must have a necessity-based purpose recognized by Art. 9 or the data subject's consent, and must determine in writing, before processing begins, the purpose, volume, storage period, and destruction procedure for that biometric data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Article 9(1) of the Law on Personal Data Protection, under which biometric data "may be processed only if this is necessary" for the listed purposes, leave room for processing on the data subject's written consent under Article 6(1)(a) for a purpose the list omits?
What it makes you log
Logging duty
Before processing biometric data the controller must determine in writing the purpose and amount of the data, the storage period, the storage and destruction procedure and the mechanisms protecting the data subject, so a written determination exists to be produced. The article names no log or register and sets no retention period for that written record.
- Kind
- Implicit
- As of
- Provision
- Article 9(2)
- Trigger
- personal_data_processing
What this law does
Art. 3(d) defines biometric data as data processed using technical means and related to the physical, physiological or behavioural characteristics of a data subject, such as facial images, voice characteristics or dactyloscopic data, which allow the unique identification or confirm the identity of that data subject, naming voice and face directly rather than leaving them implicit, the closest match to General Data Protection Regulation (GDPR) Art. 4(14)'s formulation in this batch.
Art. 9 is a dedicated biometric-data article, independent of the Art. 6 special-categories list: biometric data may be processed only for an enumerated list of necessity-based purposes (security or property protection where no less-intrusive means exists, identity-document issuance, border-crossing identification, migration control, international-protection implementation, crime prevention and investigation, detention or sentence enforcement, minor-welfare coordination, operative-investigative activity, information or cyber security, or another case a law directly provides for), and Art. 9(2) requires the controller to determine in writing, before processing begins, the purpose and volume of the biometric data to be processed, its storage period, its storage and destruction procedure and conditions, and the mechanisms for the protection of the rights of the data subject.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .