SloveniaZVOP-2 Chapter 4 (Articles 81-84) and Article 80, Biometric and Genetic Data
In force since .
A biometric privacy rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Process biometric personal data of a person in Slovenia in the private sector only where it is necessary for your activity, the safety of people or property, or the protection of classified data or trade secrets, with the processing operations certified under ZVOP-2 Article 52, and use biometrics to verify a customer's identity only where a law, the contract or the customer's explicit consent provides for it, under ZVOP-2 Article 83.NIST Privacy FrameworkCT.PO-P1
- Before starting to process biometric personal data in the private sector, send the Information Commissioner a description of the intended processing and the reasons for introducing it, and begin the biometric measures only after receiving its decision allowing them, unless the measures are carried out as ZVOP-2 Article 83(3) provides (data under the customer's exclusive control and certified under Article 52), under ZVOP-2 Article 83(5), (6), (7) and (9).NIST Privacy FrameworkGV.PO-P5
- Do not deploy automated license-plate recognition or a biometric-recognition system on a public surface in Slovenia, under ZVOP-2 Article 80.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: Informacijski pooblaščenec (Information Commissioner of Slovenia) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ip-rs.si/varstvo-osebnih-podatkov/obveznosti-upravljavcev/prijava-biometrijskih-ukrepov/
- Guidance body
- Informacijski pooblaščenec (Information Commissioner of Slovenia)
- Open questions
- Which accredited body certifies biometric processing operations under Article 52 of ZVOP-2, which Article 83 requires of a private-sector controller, now that the transitional rule in Article 121 treating processing as compliant with the certification criteria ran only to for applicants?
What it makes you log
Log retention
The ceiling applies to video surveillance recordings made on public surfaces, counted from the moment each recording is made; it limits the recordings and does not create a log.
- Unit
- Months
- As of
- Basis
- Fixed
- Maximum value
- 6
Logging duty
Chapter 4 and Article 80 limit when biometric and genetic data and public-surface video surveillance may be used. They state no duty to create, keep or produce a log or record. The six-month ceiling in Article 80(6) is a limit on how long the video recordings themselves are kept, not a record duty. Article 76(12), which this row does not cite, requires a video surveillance operator to log every viewing or use of recordings, and Article 22 is the general processing-log rule.
- Kind
- None
- As of
What this law does
ZVOP-2 Part II Chapter 4 regulates the processing of personal data using biometrics and genetic data. Article 81(1) states processing of biometric personal data contrary to this chapter's provisions is prohibited. Article 81(2) requires any other law that provides for biometric processing to set the conditions of its use as well.
Article 81(3) bars linking biometric-data collections with other collections, or enabling their General Data Protection Regulation (GDPR) Article 20 portability, unless another law provides otherwise or the person concerned consents. In the private sector, Article 83(1) allows biometric processing only where it is necessary for the activity, the safety of people or property, or the protection of classified data or trade secrets, and the processing operations must be certified under Article 52.
Article 83(2) allows a private person to process biometric data to verify the identity of its customers where another law, the contract or the customer's explicit consent provides for it. Article 84 bans requiring or obtaining biometric personal data in exchange for services in the course of marketing.
Separately, in Chapter 3 (Video Surveillance), Article 80 bans, on public surfaces, automated license-plate-recognition systems and systems processing biometric personal data, backed by Article 105 fines of EUR 5,000 to 20,000, or EUR 10,000 to 30,000 for a medium-sized or large company. Article 80 is entirely a public-video-surveillance provision. Article 5(1) gives the Act's terms the meaning they have in GDPR Article 4, so biometric data takes the GDPR Article 4(14) definition. Article 5(2) adds twelve further definitions, and none concerns voice data or a voiceprint.
When LexLint raises it
When your app profile says your app processes biometric data, sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .