Legal framework for biometrics

Now at ATMs you can see a cheering inscription that soon devices with money will begin to recognize us by face. Recently wrote about it here .

Wow, you'll have to stand in line less.

IPhone again distinguished by a camera for removing biometric data.

A single biometric system (EBS) will serve as the foundation for making these milestones of the future a reality.

The Central Bank rolled out a list of threats from which operators working with biometric personal data should be ready to protect customers, and in February presented guidelines on how to eliminate hazards.

The next set of rules should minimize the following risks:

• The risks that arise when collecting biometric data.
• The risks that arise when processing people's requests and working with their personal data.
• Risks arising from remote identification.

For this offer:

• Register each of the operators.
• Use only certified products.
• Issue e-signature keys to operators.
• Inform the Central Bank of all incidents.

Let's get back to the background. 10 years after the first legislative movements in this area, Russia began issuing passports that could legally contain electronic data carriers.

Over time, the 152nd federal law was only supplemented. In the 11th article of the law, it was stated that biometrics is information that characterizes the physical (then added, as biological) characteristics of a person, on the basis of which his personality can be established. Then they added that these biometrics operators use to identify the person, and the processing of these data is possible only with the written consent of the client.

An exception will be only if they find that the client is a terrorist.

We decided that such data should be protected:

• From illegal or accidental access to them.
• From destruction or change.
• From blocking.
• From copying.
• From providing access to them.
• From spread.

The next step was standardization for the world level. She touched fingerprints, face images, DNA data. In 2008, we wrote down requirements for material carriers and storage technologies outside the personal data information system.
By media, they mean only devices that a robot can read without scanning. Paper materials do not count.

The requirements are as follows:

• Providing access only to authorized persons.
• The ability to determine the system and its operator.
• Prevent rewriting outside the information system and unauthorized access.

Should be provided:

• Using a digital signature or other way to preserve the integrity and immutability of data.
• Check whether there is a written consent of the subject of personal data.

The Unified Biometric System is based on federal law 149. It connects it with the Unified Identification and Authentication System. Operators identify a person with his consent and in his presence. And then send the data to the EBS.

The government determines how to collect, transfer, process data and appoints a warden for all of this. Now Rostelecom has become responsible for the development of regulations.

In addition, monitors and supervises the FSB and FSTEC.

The FSB requires crypto protection from banks in the first place. In addition, a bank that insures deposits has the right to contribute Biometric Data to the EBU and remotely identify it for the provision of basic services, unless it is a terrorist or so.

As always, life makes its own adjustments to everything that the state has regulated. In particular, during the test purchase, the Central Bank revealed shortcomings both in the system itself and in case of remote identification when rendering services.

Many banks duck generally traditionally reported formally, but in fact did not even work out the interaction with customers.

Time moves forward, preparing the legislative ground so that cyborgs can recognize us. And we are ready to provide a cloud infrastructure that meets all such laws.