MongoliaLaw on Protection of Personal Data, biometric information definition and legacy fingerprint destruction
Law on Protection of Personal Data (), Art. 4.1.1; Art. 31
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that captures a fingerprint, iris scan, faceprint, voiceprint, or body-movement identifier from a Mongolian data subject is processing biometric information under the Law's own definition, which explicitly names voice and face. An identifier extracted from a recording via technical means or software falls squarely within this definition. An app or its predecessor that collected fingerprint data before must destroy it unless separately authorized by law.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
The Minister's order of on processing sensitive, genetic and biometric information adopts the Law's own definitions and does not define biometric information itself.
- As of
- Open questions
- Does a faceprint or voiceprint that software derives from a recording, rather than one read from the person's body, count as "биеийн давхцахгүй өгөгдлийг" ("unique bodily data") that allows identification under Article 4.1.1?
What it makes you log
Logging duty
Article 4.1.1 defines biometric information, and Article 31.1 requires a controller to destroy fingerprint data it collected before the Law took effect unless a law permitted the collection, with a government working group organizing and supervising that step (Article 31.2). It is a one-time destruction duty on personal data, not a log, register or record, and it is not coded as a retention rule for a record.
- Kind
- None
- As of
What this law does
Art. 4.1.1, read in full, defines biometric information as unique bodily data allowing identification of a person with the help of equipment, technical means, or software, and explicitly lists fingerprint pattern, iris, face, voice, and body-movement characteristics as examples, the only jurisdiction in this batch whose statute names a voice or face modality.
Art. 31 (Transitional provisions), read in full, requires destruction of fingerprint data collected by an information controller before the Law entered into force, except as authorized by law, with a government-organized working group to oversee that destruction, a concrete retroactive remediation duty with no parallel found elsewhere in this batch.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .