KyrgyzstanDigital Code, special categories of personal data
Digital Code, Law No. 178, Art. 80
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that processes biometric data for the digital identification of a Kyrgyzstani data subject, including a voiceprint or faceprint, must satisfy one of Art. 80(2)'s narrow lawful grounds before processing; such processing is prohibited by default otherwise. The Code itself supplies no illustrative list of biometric modalities for this general provision.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Article 80(1)(3), which prohibits processing "биометрических данных для цифровой идентификации физического лица" ("biometric data for the digital identification of a natural person"), reach a faceprint or voiceprint used only for digital authentication, given that Article 1 defines "цифровая идентификация" ("digital identification") as a search of a digital record to link it to a data principal and defines "цифровая аутентификация" ("digital authentication") separately as confirming the link between an identifier and the person it belongs to?
- Article 80(2) lists eleven cases that lift the prohibition and none is the data subject's consent; may a record owner process "специальных категорий персональных данных" ("special categories of personal data") on consent under Article 79(2) alone?
- Which law supplies the measures that Article 80(2) requires before the prohibition is lifted, namely "меры защиты от недобросовестной обработки данных и меры предотвращения вреда субъекту персональных данных" ("measures of protection against unfair processing of data and measures to prevent harm to the data subject"), for a private record owner relying on contract necessity?
What it makes you log
Logging duty
Article 80(1) prohibits processing of special categories of personal data (racial or ethnic origin, political views, religious or philosophical beliefs, trade-union membership, genetic information, biometric data for the digital identification of a natural person, and data on health, sex life or sexual orientation). Article 80(2) lifts the prohibition in eleven cases where the law lays down and applies safeguards against unfair processing and measures to prevent harm to the data subject. Neither paragraph requires a log or record, names an audit, or sets a territorial test. English: processing of these categories is prohibited unless one of the listed cases applies.
- Kind
- None
- As of
What this law does
Art. 80(1), read in full and confirmed word for word against the official portal, prohibits processing by default: data revealing racial or ethnic origin, political views, religious or philosophical beliefs, or trade-union membership; genetic information; biometric data for the digital identification of a natural person; and data concerning health, sex life, or sexual orientation.
Art. 80(2) lifts the prohibition for contract necessity, explicit statutory authorization, vital-interest necessity, data the subject has explicitly made public, medical or public-health purposes, and (in part) membership processing by an association or religious organization.
No definition of biometric data as a general term was found anywhere in the official Code text (confirmed by a search for the root "биометрич" (biometric) across the whole document, which surfaces only Art. 48's state-system provisions and Art. 80(1)(3)'s bare category name); the only enumerated biometric-modality list in the Code is Art. 48(3)'s narrower, government-identification-system-specific list, confirmed at the official source to read exactly: digital facial image, papillary-pattern fingerprints of both hands, and handwritten signature, naming no voice modality, which should not be read as governing this general provision.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .