TajikistanLaw on the Protection of Personal Data, biometric personal data
Law No. 1537 (), Art. 17; Art. 1; Art. 11
In force since .
A biometric privacy rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that processes a faceprint, voiceprint, or other biometric identifier of a Tajikistani data subject for identification purposes must obtain the subject's written consent, unless the processing falls within a justice, security, or law-enforcement exception. Confidentiality of biometric data specifically is deferred to other Tajik legislation, which the Act does not name and which is not identified here.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Article 17, which applies to biometric data that are "используются оператором для установления личности субъекта персональных данных" ("used by the operator to establish the identity of the personal data subject"), reach a voiceprint or faceprint used only to authenticate a returning user?
- Does a voiceprint or a behavioral signal fall within "физиологические и биологические особенности" ("physiological and biological features"), the only description of biometric personal data in Articles 1 and 17, which name no modality?
- Which legislation is meant by Article 13's statement that the confidentiality of biometric data "устанавливается законодательством Республики Таджикистан" ("is established by the legislation of the Republic of Tajikistan")?
- Does the "письменного согласия субъекта персональных данных" ("written consent of the personal data subject") required by Article 17 admit consent given in electronic form, given that Article 11 refers consent to the forms "установленных законодательством"?
What it makes you log
Logging duty
Article 17 requires the subject's written consent to process biometric data used to identify the subject, with law enforcement and security exceptions. Written consent is a condition of processing, and the article does not require the operator to keep or produce a record of it. Article 11 leaves the form of giving or withdrawing consent to legislation and Article 1 only defines biometric data. The duty to produce evidence of consent is in Article 25, which this row does not cite. The cited articles have no territorial scope clause.
- Kind
- None
- As of
What this law does
Art. 17, read in full, requires the subject's written consent to process biometric personal data for identification purposes, except in connection with criminal prosecution, administration of justice, enforcement of judicial acts, or defense, security, counter-terrorism, extremism, corruption, and money-laundering matters.
The Art. 1 definition is general, with no illustrative list naming face, voice, or fingerprint: personal data determining the physiological and biological features of the subject. Art. 11 defers biometric confidentiality specifically to unnamed other Tajik legislation, the same deferral pattern this batch also finds word for word in Kazakhstan's Art. 11(3) and Turkmenistan's Art. 7(7).
A dedicated, consent-gated biometric article does exist, so biometric data carries a heightened restriction here. Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as , the same day it was signed.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .