Placement of biometric personal data in the Unified Biometric System

In August 2023, MFCs (Public Service Centers) unexpectedly faced a rush of citizens’ demand for the service of registration of refusal to collect biometric personal data. The reason is the rumors spreading that if you do not submit the appropriate application by 31.08.2023, biometric data of citizens will begin to collect uncontrolled by various organizations, primarily banks and telecom operators.

Who collects and processes personal data?

State bodies, municipal bodies, legal entities and individuals.

What is biometric personal data?

According to the Federal Law of 27.07.2006 N 152-FZ “On Personal Data” – this is information that characterizes the physiological and biological features of a person, on the basis of which it is possible to establish his/her identity.

Is it possible to process biometric personal data without the consent of an individual?

Processing of biometric personal data may be carried out without the consent of the personal data subject in connection with the implementation of international treaties, in connection with the implementation of justice and execution of judicial acts, in connection with the mandatory state fingerprinting or genomic registration, as well as in cases provided for by the legislation of the Russian Federation on defense, on security, on countering terrorism, on transport security, on countering corruption, on operational and investigative activities, on public service

In other cases, according to Article 11 of the Federal Law of 27.07.2006 N 152-FZ, biometric personal data are provided by an individual only with his/her consent. At the same time, a citizen cannot be denied service if he/she refuses to provide them and (or) give consent to the processing of personal data.

What is the Unified Biometric System (UBS)?

This is a state information system that contains biometric personal data of individuals, vectors of the unified biometric system and other information provided for by the Federal Law of 29.12.2022 N 572-FZ. The operator of the UBS is the joint-stock company “Center of Biometric Technologies”.

Until June 1, 2023 state bodies, municipal bodies, legal entities and individuals could store biometric data collected by them. On the basis of paragraph 2 of Article 26 of the Federal Law of 29.12.2022 N 572-FZ until September 30, 2023 they are obliged to place these data in the UBS. The consent of an individual was not required for such placement. It was only required to notify them in any form allowing to confirm the fact of receipt of the notification 30 days prior to the planned placement (i.e. not later than August 31, 2023). In case of receiving an objection from the personal data subject against the placement of his/her data in the unified biometric system, such placement was not carried out.

Between June 1, 2023 and the date of transfer of biometric personal data to the UBS, the persons who have stored the data are obliged to destroy them. Para. 3, paragraph 1, Article 15, item 1 of the Federal Law of 29.12.2022 N 572-FZ provides them with the possibility to temporarily store biometric personal data for no more than 10 days when considering appeals of personal data subjects who presume unlawful processing of their biometric personal data during authentication and (or) contesting the results of authentication. After that, the data is subject to destruction. I.e. from September 30, 2023 biometric data shall be permanently stored only in the UBS.

What biometric personal data is hosted and processed in the UBS?

Until September 1, 2024:

1. an image of a person’s face obtained with the help of photo-video devices;
2. a recording of a person’s voice obtained with the help of sound recording devices.

From September 1, 2024 all types of biometric personal data defined by the Government of the Russian Federation in coordination with the federal executive body in the field of security and the Coordination Council.

Is it possible to refuse to collect and place biometric data in the UBS and delete it?

From June 1, 2023, an individual in person at a multifunctional center for the provision of state and municipal services has the right to submit in writing a refusal to collect and place his biometric personal data for the purposes of identification and (or) authentication. In case of submission of such a refusal by an individual, collection and placement of his biometric personal data in the unified biometric system is prohibited until the individual revokes the previously submitted refusal. At the same time, the law does not explicitly state whether biometric data, which have already been placed in the UBS, will be deleted or destroyed after the submission of such a waiver. However, since refusal to place the data in the database implies refusal to store them, logically the UBS operator should delete the data from the system.

From January 1, 2024, clause 14 of Article 3 of the Federal Law of 29.12.2022 N 572-FZ comes into force, which provides for the right of a natural person through the portal Gosuserv https://www.gosuslugi.ru/ to withdraw consent to the placement and processing of biometric personal data in the UBS, as well as to send to the UBS operator a request to block, delete, destroy biometric personal data and (or) vectors of the UBS. In case an individual revokes his/her consent to the processing of his/her biometric data or sends a request for blocking, deletion, destruction, biometric personal data and (or) UBS vectors shall be blocked, deleted, destroyed, respectively.

Conclusions

If your biometric data are in the databases of various authorities and organizations, then until 30.09.2023 these data are to be transferred to the UBS – state information system. The owners of these databases should have notified you about the forthcoming transfer of your biometric data by August 31. In order to prevent your data from being transferred to the UBS, you had to submit your objection in response to the notification. Otherwise, your biometric data will be placed on the UBS. It is difficult for each of us to assess the consequences of merging biometric personal data from disparate sources into a single state information system.

How to delete biometric personal data from the UBS?

If a natural person does not want his/her biometric data to be stored in the UBS, he/she has the right to submit a written application to refuse the collection and storage of his/her biometric personal data in the UBS. There is no time limit for submitting such an application. Logically, after receiving such an application, biometric data should be deleted from the system, although this is not explicitly stated in the Federal Law of 29.12.2022 N 572-FZ.

As of January 1, 2024, it will be possible to withdraw consent to the placement and processing of biometric personal data in the UBS via the State Services, as well as to send a request to block, delete or destroy such data from the UBS.