Description

Bill requiring notification of use and prohibiting sale of biometric information becomes law

On 10 January 2021, Bill 1170-2018, which requires businesses to notify customers of the use of biometric identifier technology and prohibits the sale of biometric identifier information, was put into force with a grace period as the mayor has not vetoed or signed it within the given deadline. The law's provisions will enter into force after 180 days, on 9 July 2021. The bill will require businesses using biometric identifier technology to disclose this fact clearly and conspicuously to customers. Further, the sale or exchange of biometric identifier information will be prohibited.

Original source

Scope

Policy Area
Data governance
Policy Instrument
Data protection regulation
Regulated Economic Activity
cross-cutting
Implementation Level
subnational
Government Branch
legislature
Government Body
parliament

Complete timeline of this policy change

Hide details
2018-10-17
under deliberation

On 17 October 2018, Bill 1170-2018, which requires businesses to notify customers of the use of bio…

2020-12-10
adopted

On 10 December 2020, Bill 1170-2018, which requires businesses to notify customers of the use of bi…

2021-01-10
in grace period

On 10 January 2021, Bill 1170-2018, which requires businesses to notify customers of the use of bio…

2021-07-09
in force

On 9 July 2021, Bill 1170-2018, which requires businesses to notify customers of the use of biometr…

Key regulatory dimensions

Regulated subjects

The businesses, government agencies or individuals affected by this policy or regulatory change.
producer / supplier
1
Type Private organisation
Economic activity cross-cutting
Category All

Policy change by business practice

The detailed activities within the scope of this policy or regulatory change.
personal data: biometric: sale
Regulatory tool
Purpose/processing limitation
Private right of action
Sanctions
Civil penalty
Regulated subjects
1
personal data: biometric: data collection
Regulatory tool
User notification requirement
Private right of action
Sanctions
Civil penalty
Regulated subjects
1
personal data: biometric: data processing
Regulatory tool
User notification requirement
Private right of action
Sanctions
Civil penalty
Regulated subjects
1

Policy change by business practice

The detailed activities within the scope of this policy or regulatory change.

personal data: biometric: sale

personal data: biometric: data collection

personal data: biometric: data processing