Personal Data Protection Inspector Elaborated Special Notification Form on the Processing of Biometric Data
2013-11-22 13:23:31For the purposes of establishing uniform practices, the Personal Data Protection Inspector elaborated special notification form on processing of the biometric data. Under the current legislation, data controllers are obliged provide detailed information to the Personal Data Protection Inspector about the processing of the biometric data including the purposes of the processing, time for which personal data is stored, methods of destruction of the data, etc.
Biometric data is data that is unique and permanent for every person and that can be used for unique and precise identification of his person. For example: fingerprints, iris, DNA, etc.
Due to the specific characteristics of the biometric data, its processing is related to the significant risks. In particular, illegal access and processing of such data might result in discrimination, infringement of the constitutional right to privacy and danger for the person’s security and property.
According to the Georgian legislation, processing of biometric data is possible only for the purposes of legitimate activities, protection of person’s property and safety and to avoid disclosure of the confidential information. Furthermore, it shall be impossible to achieve these purposes by other means or shall be related to unreasonably disproportionate efforts.
When processing the biometric data it is necessary to ensure existence of appropriate, relevant and proportionate security measures in order to avoid data breaches. It is also important to provide strict regulations and limitations on as well as recordings of access to such data.
Private organizations are obliged to inform Personal Data Protection Inspector prior the processing of biometric data on the processing of such data through filling out the special notification form.
Taking into consideration the risks related to the processing of the biometric data, the Personal Data Protection Inspector calls upon the data controllers to process biometric data in full compliance with the legislation and, if necessary, consult the Inspector.