UruguayLey N° 18.331, biometric data
In force since .
A biometric privacy rule binding public and private bodies.
- Obligation class
- Biometric, DPIA, Consent
- Audit expectation
- none
What it requires
- Before processing biometric data, such as fingerprint data or facial or voice recognition used to identify a person, carry out a data protection impact assessment.NIST Privacy FrameworkID.RA-P4
- Process biometric data only within a lawful basis under article 9 of Ley N° 18.331 (typically the data subject's free, prior, express, and informed consent), since biometric data is not exempt from that consent framework.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Decision basis
Logging duty
Article 18-BIS allows biometric data to be processed only after a data protection impact assessment has been carried out. An assessment is a written evaluation the controller has to hold, so the article is read as a record duty over the assessment. Article 4(Ñ) only defines biometric data. The article states no content for the assessment (Decreto N° 64/020, Article 7, outside this row, sets its minimum content), no period for keeping it, no audit and no body entitled to it. No territorial clause sits in the cited articles.
- Kind
- Implicit
- As of
- Provision
- Ley N° 18.331, art. 18-BIS (a data protection impact assessment before processing biometric data)
- Trigger
- personal_data_processing
What this law does
Article 4, literal Ñ, added by Ley N° 19.924 art. 86, defines biometric data as personal data obtained from a specific technical process relating to a natural person's physical, physiological, or behavioral characteristics that allow or confirm their unique identification, such as fingerprint data, image recognition, or voice recognition.
Article 18-BIS, added by Ley N° 19.924 art. 87, requires that any processing of biometric data first pass through a data protection impact assessment and fit within one of the lawful bases article 9 allows, a dedicated duty distinct from the sensitive-data list at article 4 literal E, which does not name biometric data.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .