KosovoLaw No. 06/L-082 on Protection of Personal Data, use of biometric characteristics
Law No. 06/L-082 on Protection of Personal Data, arts. 80-83 (use of biometric characteristics)
In force since .
A biometric privacy rule binding public and private bodies.
- Obligation class
- Biometric, Consent, Licensing
- Audit expectation
- none
What it requires
- Before determining, using or comparing a data subject's biometric characteristics to identify them, confirm this chapter's dedicated rules apply rather than the law's general processing rules alone.
- In the public sector, use biometric characteristics only where strictly necessary for the safety of individuals, the protection of property, or safeguarding confidential data and trade secrets, and only where no easier means would achieve that purpose.NIST Privacy FrameworkCT.PO-P1
- In the private sector, apply the same necessity test, inform employees in writing in advance of the measures and their rights, and submit a detailed description of the proposed measures to the Agency for Information and Privacy before taking them.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkGV.PO-P5
- Do not implement a private-sector biometric measure until the Agency has authorised it, which the Agency must decide within thirty days of receiving your submission.NIST Privacy FrameworkGV.PO-P5
- Where biometric characteristics are used for access control in the public sector, apply the entry and exit records chapter's retention and handling safeguards to that use.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 80 to 83 allow biometric characteristics to be used only where strictly necessary for safety, property or confidential information, and the private sector must first give the Agency a detailed description of the measures (Article 83(2)) and obtain its authorization (Article 83(4)). That is a filing and an approval, not a record the controller keeps. Article 82 applies Article 84(2) to (4) to biometric access control, which sets what entry data may be held and caps it at three years, a limit on the personal data and not a rule that a log be kept. The row imposes no log or record duty.
- Kind
- None
- As of
What this law does
Article 80 subjects the determination and use of a data subject's biometric characteristics, and their comparison to enable identification, to this chapter's dedicated rules. Article 81 lets the public sector use biometric characteristics only where strictly necessary for the safety of individuals, the protection of property or the safeguarding of confidential data and trade secrets, and only where that cannot be achieved by other means.
Article 82 lets the public sector use biometric characteristics for access control, applying the entry and exit records chapter's retention and handling rules to that use. Article 83 lets the private sector use biometric characteristics under the same necessity test, requires employees to be informed in writing in advance of the measures and their rights, and requires the controller to submit a detailed description of the proposed measures to the Agency before taking them.
Article 83(3) gives the Agency thirty days to decide whether the proposed measures comply with the law. Article 83(4) lets the controller implement biometric measures only after receiving the Agency's authorisation.
Whether a voiceprint falls inside these biometric-use rules is not established by the law's own text: the general biometric-data definition's core clause covers behavioural characteristics used for unique identification, but its illustrative list of examples names fingerprints, iris, retina, facial features and DNA and does not name voice.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .