RussiaFederal Law No. 572-FZ, Unified Biometric System for Identification and Authentication
In force since .
A biometric privacy rule binding public and private bodies.
- Audit expectation
- continuous
- Who audits it
- Regulator
What it requires
- Route biometric identification, matching an unknown person against a database, of a person in Russia only through the state Unified Biometric System; a private accredited system may only perform authentication, using derived mathematical vectors rather than the original template, and may not transmit those vectors to a third party.NIST Privacy FrameworkCT.PO-P1
- Obtain written consent before processing a person's biometric data in Russia, never condition service on that consent, and retain any biometric sample your organization holds only up to 10 days before deleting it, since the durable copy of record lives in the state system.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Must a person whose biometric record a bank already holds consent again before it is transferred into the Unified Biometric System, or does the "ранее данное согласие" ("previously given consent") carry over?
What it makes you log
Logging duty
Article 4(6)(1) has the Government set the requirements for recording the actions taken when a bank, multifunctional center or other organization places a person's biometric data and identity details in the Unified Biometric System (требования к фиксированию действий при размещении сведений). The Act itself imposes no named log and no retention period on the placing organization; the requirement is delegated to a Government instrument. Article 4(8) requires the federal laws that oblige those organizations to place the data to provide for control and supervision of those actions by a designated authority, the Central Bank for financial-market organizations. The Act also bars storing biometric data used for authentication beyond ten days (Articles 14 to 16), which limits the data, not a log. The audit keys on this row were set earlier from Article 16(12) and are unchanged. The scope article names no territorial reach.
- Kind
- Implicit
- As of
- Provision
- Article 4(6)(1)
- Trigger
- personal_data_processing
What this law does
Federal Law No. 572-FZ establishes the Unified Biometric System (Edinaya biometricheskaya sistema, EBS), a state information system for identifying and authenticating individuals from face and voice biometrics, and it is genuinely distinct from every other biometric regime. "Identification", matching an unknown person against the whole database, may be performed only through the state EBS.
"Authentication", verifying a claimed identity, may use the EBS or a private accredited system, but an accredited authentication system works only with derived mathematical vectors, never the original biometric template, and may not transmit those vectors to a third party.
Organizations that process biometric data for identification or authentication, banks, employers, security operators, call centers, must route identification through the state system; reporting documents that the law obliges banks and state agencies to deposit client face and voice biometrics into the EBS, and that the Central Bank has moved to bar branches from opening accounts or approving loans via mobile app without biometric authentication.
A broader duty for every prior private holder of biometric data to transfer its existing database into the EBS and destroy its own copy is not established; only the narrower duty for banks and state agencies to deposit new biometrics is. Written consent is required under Article 11 of 152-FZ, cross-referenced by 572-FZ, and 572-FZ separately bars denying service to someone who declines biometric processing, except where a separate federal law affirmatively mandates identification.
Accredited organizations may retain a biometric sample only up to 10 days, solely to process a complaint; the durable copy of record lives in the state EBS. Voiceprint and faceprint are both squarely in scope, the statute's subject matter is literally identification and authentication using face and voice biometrics, and there is no carve-out for either.
Whether individual consent is still required before an already-collected biometric record is transferred from a bank into the EBS, as distinct from consent to the original collection, is unresolved.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .