RussiaFederal Law No. 152-FZ, Articles 10-11, Special Categories and the Biometric Data Definition
Federal Law No. 152-FZ, Art. 10-11
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain written consent before processing biometric personal data of a person in Russia, including an identifier such as a facial image or voice recording that would fall under Article 11's general definition, unless a narrow Article 11(2) statutory exception applies.
- Never make provision of biometric data a condition of service to a person in Russia, except where a separate federal law affirmatively mandates identification.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a facial image or voice recording count as biometric personal data under Article 11(1) when the operator does not use it "для установления личности субъекта персональных данных" ("to establish the identity of the personal data subject")?
What it makes you log
Logging duty
Articles 10 and 11 require the data subject's written consent (согласие в письменной форме) before special-category or biometric data is processed, and Article 11(3) bars making biometric data compulsory. Neither article tells the operator to keep a record or log, or to prove the consent. The operator's burden of proving consent sits in Article 9(3), which this row does not cite.
- Kind
- None
- As of
What this law does
Article 10 of 152-FZ names special categories, race and ethnicity, political opinion, religious or philosophical belief, health, sex life, and criminal record data, requiring written consent or a statutory exception. Article 11 separately defines "biometric personal data" as information characterizing a person's physiological and biological features on the basis of which their identity can be established, used by the operator for that purpose.
The article's own text is entirely general and technology-neutral. It carries no illustrative list of modalities at all, and no mention of facial images, voice recordings, fingerprints, or DNA anywhere in the article. Written consent is required for biometric processing, and provision of biometric data cannot be made mandatory, except where Article 11(2)'s statutory exceptions apply.
On that same general wording, an identifier derived from a photograph, video, or audio recording is not excluded: the definition simply never names any modality, recording-derived or otherwise, so nothing in the text carves one out.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .