CroatiaCroatian Act Articles 21-23, Biometric Data by Sector
Zakon o provedbi Opce uredbe o zastiti podataka, Arts. 21-23
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Obtain the data subject's explicit General Data Protection Regulation (GDPR)-compliant consent before processing biometric data of a person in Croatia for the individual, secure identification of a service user, per Act Article 22(2).
- Offer a non-biometric alternative and obtain explicit consent, or rely on a legal prescription, before deploying employee biometric time-and-attendance or access-control processing in Croatia, per Act Article 23.
These lines are LexLint's reading of the law's text. Also read by: Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://azop.hr/predstavlja-li-obrada-osobnih-podataka-s-biometrijske-osobne-iskaznice-obradu-biometrijskih-osobnih-podataka/
- Guidance body
- Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency)
- Open questions
- Must an employer offer a non-biometric solution to every employee as the 'another solution' of Article 23 of the Act before biometric recording of working time or of entry to and exit from premises is permitted, or may it offer one only to employees who refuse consent?
What it makes you log
Logging duty
Articles 21 to 23 set when public bodies, private bodies and employers may process biometric data, and Article 23 requires the employee's explicit consent for biometric time-and-attendance or access control. They state no duty to create, keep or produce a log or record. The automated access log for video surveillance recordings (Article 28(4)) sits outside the articles this row cites.
- Kind
- None
- As of
What this law does
Croatia regulates biometric processing by sector rather than a single undifferentiated rule. Article 21 permits public-authority biometric processing only where provided by law and necessary to protect persons, property, classified data, or business secrets, or to fulfil international border-crossing identification obligations.
Article 22 permits private-sector biometric processing where prescribed by law or necessary for those same protective purposes, or for the individual, secure identification of service users, with the last purpose requiring the data subject's explicit General Data Protection Regulation (GDPR)-compliant consent as its legal basis; the other Article 22(1) grounds do not require consent on this reading.
Article 23 permits employee biometric processing for recording working time or entry to and exit from official premises where prescribed by law, or as an alternative to another solution for the same purpose, on condition the employee has given explicit consent.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .