Will Photos be Considered to Be Biometric Personal Information?

In May 18, 2015 RA law on “the Protection of Personal Data” (hereinafter referred to as Law) was adopted. Article 23 of the Law defines the requirement of  notifying [1] the competent authority on the processing of personal data.

Particularly, according to Part 3 of Article 23 (it is quoted), “The processor shall notify to the Personal Data Protection competent authority about its intention to develop data, prior to biometric personal or special category data processing”. Meanwhile, according to the law “The information characterizing the physical, biological and physiological characteristics of the person” is considered biometric data (emphasis is added by us).

Thus, a question arises whether  photo of the employee provided to the employer (size, 3X4) which is, in practice, attached to the employee’s personal sheet will be considered personal biometric data.

According to position (position ATPD -001 / 16) issued by Personal Data Protection Agency (hereinafter Agency) of RA Ministry of Justice, the factor to be considered depending on the purpose of the photograph is to identify the person and / or verify his identity (emphasis added by us).

Respectively, two groups of photos are distinguished

  1. Photos that do not peruse the purpose of person identification (e.g., photos taken with friends or family)
  2. Photos that pursue the purpose of person identification (e.g. photos taken for identification by means of , for example, a search engine or other security or identification systems, identification, recognition, monitoring and other purposes)

So it follows that the photos of the first group are not considered to be biometric information.

As for the fact of the photos, handed on the part of the employee to be considered biometric information, the agent it connects to the purpose of photo processing as well. Thus, in case a photo of 3×4 size is taken in the way determined with the law or with the consent of the employee for the purpose of identifying or checking identity, it will be considered a biometric information. At the same time, if the photo is collected in a purpose other than the identification/checking of the identity, but since a certain moment with the consent of the employee or in the cases determined by the law it is being used for identifying or checking identity, then starting from that very moment the photo will be considered a personal biometric data.

While processing personal data it is very important to consider the principle of proportionality, determined by the law, according to which data processing must pursue a legitimate aim, and the ways of acquiring it must be appropriate, necessary and proportional. Meanwhile procession of such data, which is not necessary for data processing or are incompatible with it, is prohibited in case it is possible to reach the purpose of data processing in a non-personalized way.

Note: as you know, in certain cases RA legislation demands that the employees of a certain category undergo initial and periodic medical examinations while applying for a work or during the work. The results of such checking are recorded in medicine books in which a photo of the employee is also relevant. In fact, the photos attached to the medical books/health books of the employees are considered biometric personal data as the form of the books require a photo as an identification element.

In contrast to the personal papers booklet applied by employers, no other identification data (e.g. passport details) are filled. This circumstance suggests that the the photo attached to personal papers is not considered a identifying data as for filling that paper the employee hands to the employer the copy of his passport.

Unlike “personal papers” booklet is used by employers to the individual identification data (for example, passport data) are not filled. This fact suggests that “personal form” has posted a photo identification will be given as to the form filling, the employee provides the employer with a copy of your passport for identification.

 

[1] Notification requirements are presented in Article 23, Paragraph 4.

Looking for a First-Class Consultant?