Authorities Propose Collecting Russians’ Biometric Data Without Consent
The Ministry of Digital Development has proposed eliminating the requirement to obtain citizens’ consent for transferring their biometric data to the Unified Biometric System (UBS) from various sources, according to a draft order cited by “Kommersant.” The authors believe this will strengthen data security. In the explanatory note, they refer to amendments to the “Information Law” adopted in early July, which allow biometric data to be placed in the UBS from other information systems without the subject’s consent.
The document also notes that these amendments will simplify the transfer of data from any information systems. This means data will be collected in the UBS from cameras at metro stations, banks, and public service centers (MFCs). Previously, both a facial image and a voice sample were required for transfer to the UBS, but now, if biometric data contains only a facial image or only a voice sample, it will still be placed in the state system.
To require commercial biometric systems (CBS) to transfer data to the UBS, only a voice or facial image is needed; samples no longer need to meet all UBS quality standards, noted Nikita Istomin, a lawyer at Roskomsvoboda and DRC:
“Yes, that’s correct. According to the amendments, the order’s requirements for recording actions do not apply to biometrics from CBS, and the data is still placed in the UBS. A biometric control template is created, which is used exclusively by the authorities or organizations that submitted such biometric personal data.”
The draft order also contains a more detailed list of cases for using biometric personal data. Istomin points out that the proposed changes to section 9 of Appendix 1 essentially repeat the provisions of part 18.23, article 14.1 of Federal Law 149, regarding the obligation to place biometrics from CBS in the UBS without the subject’s consent, even if it does not meet standards.
Additionally, the draft order removes the requirement for the subject’s consent from section 1 of Appendix 2, though this is a technical change since federal law takes precedence over the order. Istomin suggests that changing imperative norms to recommendations in Appendix 3 may be aimed at speeding up the UBS’s data collection, though the effect is likely minimal. In essence, the only requirement is the presence of a voice or facial image in the CBS; compliance with the new order’s standards is not needed for transfer to the UBS.
Expert Opinions and Concerns
Kirill Lyakhmanov, chief legal counsel for intellectual property practice at EBR, noted that eliminating the need for citizens’ consent to collect and update biometrics in the UBS could lead to continuous collection from any possible sources. Given the requirements for biometric samples, such sources could include surveillance cameras at metro entrances, banks, financial organizations, MFCs, and more. He also pointed out that “other organizations” could collect and update biometrics for transfer to the UBS, but the document does not specify which organizations these are.
Lyakhmanov added, “A CBS operator that has placed biometric data in the UBS is not allowed to let other CBS operators use it. This means that the UBS will contain duplicate samples of the same people who submitted biometrics to different organizations.” He emphasized that storing such a large volume of personal data in a single system makes the consequences of a data leak catastrophic.
Background and Official Clarification
In July, Russian President Vladimir Putin signed a federal law requiring all government agencies, banks, and other organizations working with biometrics to transfer all such data to the Unified Biometric System. Consent from the individuals who provided their biometrics is not required.
Update: The new draft order from the Ministry of Digital Development regarding the transfer of biometric data to the UBS does not propose eliminating the requirement to obtain citizens’ consent, according to a statement from the ministry cited by Interfax:
“In response to media reports, the Ministry of Digital Development clarifies that the draft order does not propose canceling the requirement to obtain citizens’ consent for collecting their biometric data. The draft order aims to regulate the process of importing previously collected biometric data, mainly stored in commercial systems such as banks, into the state Unified Biometric System (UBS).”
The ministry notes that the draft order is at an early stage and is being discussed with expert groups, including for assessing its regulatory impact on citizens and businesses.