Biometric PD

Biometrics is a family of technologies, not just face recognition. The legal regime depends on the modality, so choose the technology together with a lawyer

Recognition technologies, section 6

• face image
• speaker recognition

• eye image
• finger and palm print

• hand geometry
• vascular pattern

• signature dynamics
• keystroke dynamics
• odour analysis

• DNA analysis
• cardiogram
• gait and body image

Fields of use, section 7

physical access control

logical access control

time and attendance tracking

reporting

electronic signature

government and civil services

border control

law enforcement

citizen screening

clustering

Result: face and voice (in orange) fall within Law 572-FZ and the UBS; fingerprint, veins, iris and behavioural traits stay under Art. 11 of Law 152-FZ

Australia, DNA

Looks from traces

Police use Massively Parallel Sequencing: from crime-scene DNA they predict sex, eye colour, country of origin, and then hair colour, age and height

United Kingdom

Prints from a photo

Merseyside Police read the author's fingerprints from an EncroChat photo of a hand holding cheese. Outcome - 13.5 years for dealing drugs

US, $2bn

Name from a face

A The Mitre Corp neural network guesses a person's name from two options with 72-80.5% accuracy without database matching, and picks a face from a name

University of Sydney

Sexual orientation by voice

Listeners were more accurate on 60 recordings at spotting homosexual and heterosexual men; the method proved unreliable for bisexual men

Apple, patent

Ear echo

AirPods ultrasonic sensors recognise the owner by the unique echo of the ear: in other ears the music stops

What this means

Potential is not a regime

Art. 11 of Law 152-FZ turns on the purpose of establishing identity. Health or orientation inferences lead to Art. 10 special categories

Moscow, transport

Sfera found 9,007 wanted and 1,324 missing people

The video analytics system has run since 01.09.2020; 280 of the missing people found are children. The face becomes a biometric key, only law enforcement has access, and identification errors are not reported

Clearview AI: some 30bn social media photos

without owners' consent; about a million US police searches, about 450 a year in Miami

Google Street View found a mafioso after 20 years

Gioacchino Gammino hid near Madrid until a Google Maps car photographed him

SAP HR system with thermometry and recognition

linked to HR, mail and Telegram; face prints are dubbed depersonalised, yet a vector is not depersonalisation

In Russia: searching by face image in an organisation's own system is banned by Art. 15 of Law 572-FZ; the Interior Ministry and FSB get UBS data on a reasoned request

Art. 11(1) of Law 152-FZ

Biometric PD

information that characterises the physiological and biological features of a person, on the basis of which it is possible to establish his or her identity and which is used by the operator to establish identity

• 1
• Physiology and biology

a body or behaviour trait: face, voice, fingerprints, veins, genome

• 2
• Allow identification

the feature is individual enough to distinguish a person from others

• 3
• Used for identification

the operator uses the data to identify a person, hence the strict regime

• Example
• Features present
• Regime

• health data
• first without third
• special categories, Art. 10

• electronic signature
• second without first
• general regime, Art. 6

• city video before identification
• first and second without third
• general regime, Art. 6

• photo in travel passport
• direct provision, Res. No. 125, 04.03.2010
• biometrics

vs

Static

Physiology present from birth

vein pattern, finger and palm papillary patterns

iris and retina of the eye

genomic data (Art. 1(3), 242-FZ)

photo or video image of the face

Risk: a leaked feature cannot be changed, so priority goes to storage protection and short retention

Dynamic

Behavioural characteristics

voice, where physiology combines with manner of speech

signature with pressure, movement direction and stroke

keystroke dynamics, gait, touchscreen use

Risk: features are taken unnoticed, consent is less informed, so priority is transparency of collection

Debatable: GDPR names behavioural features expressly, while Art. 11(1) speaks of physiology and biology, so written consent is taken when identifying by behaviour

• 1
• Dual criterion

the provision combines data that allow identification and data that are used for it, so one photo can be biometric or not

• 2
• No notion of identification

no cross-sector definition or procedure, only rules for particular relations; the moment of identification is undefined

• 3
• Whose processing

if the reference and comparison stay on the user's device and the operator gets only the result, the operator is not processing biometrics

• 4
• Authentication not named

the rule speaks of establishing identity, not of confirming that a person is who they claim to be

• 5
• No technical means criterion

unlike GDPR, there is no criterion of special means for obtaining a reference and automated comparison

• 6
• Accuracy is no criterion

identification reliability is not a criterion, and the false accept (FAR) and reject (FRR) rates are never zero

Practice: the process, not the file, sets the regime: the classification is reviewed whenever the system's purpose changes

Third feature

Active presentation of a sample

Biometric authentication is verification of a claimed identity by presenting one's biometric sample and converting it under a predefined protocol. It is almost always coupled with authorisation, like a door lock with a fingerprint scanner

example: driver face recognition

example: biometric time tracking

Not biometrics: Digital Ministry letter 28.08.2020 No. LB-S-074-24059

passport scan to confirm a specific person's actions without identification procedures

photocopy of an identity document

photo in an employee's personal file

signature and handwriting, incl. for handwriting analysis

X-ray and fluorography images in a medical record

video recording in public places and on guarded premises

Boundary: images in a medical record stay health data under Art. 10, while a change of system purpose makes the same footage biometric with no new equipment

vs

Required

Written and free consent

written form with the Art. 9(4) particulars, handwritten or equivalent electronic signature

from 01.09.2025 a separate document, not a clause of a contract, form or offer (Art. 9(1))

for one operator and one purpose: entry, time tracking and transaction confirmation are drawn up separately

a working non-biometric route at no cost to the person who refuses

Prohibited

Coercion and refusal of service

require biometrics for a contract, account or membership, except in Art. 11(2) cases

condition a service, its scope or goods quantity on passing biometrics (Art. 3(11)-(13) of Law 572-FZ)

refuse a consumer a contract: Art. 14.8(8) of the CAO, ₽200-500k for a legal entity

deny a public service for refusing biometrics: Art. 5.63(2.1) of the CAO since 30.05.2025

Practice: consent via a one-time code in a bank's personal account was held void (88-14185/2025), and courts refused to punish an employee for not scanning a fingerprint after withdrawing consent (88-24328/2022)

10.02.2020

Roskomnadzor

No. 08AP-6782: recommendations on children's biometrics, photo classification not tied to format

28.04.2020

Roskomnadzor

No. 08-24451: state bodies may use fingerprints, a commercial organisation has no grounds

17.07.2020

Digital Ministry

No. OP-P24-070-19433: photo in ACS is biometrics, student biometrics for entry is inadmissible

28.08.2020

Digital Ministry

No. LB-S-074-24059: passport copies, personal-file photo, signature, X-ray are not biometrics

19.11.2021

Roskomnadzor

No. 09-78548: 2013 guidance counting even height and weight as biometrics is outdated

09.03.2022

NWFD regional office

No. 9627-12/78: a photo is not biometric in essence, lacking a thermogram, iris and patterns

29.08.2022

Roskomnadzor

No. 08-78032: photo is biometrics only if a regulation says so (Gov. Res. No. 125), else Art. 6

25.11.2022

Rostrud

an employer may not take employees' fingerprints for access control

Later: since August 2025, non-compliance with GOST no longer removes a photo from biometrics

• Held to be biometrics
• Court act

• photos on passes
• NW Arb. Court 21.11.2017 F07-11732/2017, Supreme Court 05.03.2018 307-KG18-101, case A42-342/2017

• students' palm vein pattern for meal payment and entry
• Liskinsky District Court 09.07.2018 No. 12-35/2018

• fingerprint template in a seafarer's identity card
• St Petersburg City Court 07.07.2020 No. 33a-13473/2020

• images from a camera in the parties' shared ownership
• 5th CCGJ 28.09.2021 No. 88-7100/2021

• minors' photos with full names in a business centre pass system
• Zelenograd District Court 23.06.2022 No. 12-0531/2022

• an employee's fingerprints after withdrawal of consent, at an organisation handling narcotics
• 2nd CCGJ 01.11.2022 No. 88-24328/2022

• employee photo on a former employer's job site
• 2nd CCGJ 04.07.2023 No. 88-13675/2023, ₽80,000 compensation upheld

• recognisable face image in a video report
• 4th CCGJ 26.09.2024 No. 88-27709/2024, remitted for retrial

Caution: check the chain of instances before citing: fitness case 12-1526/2019 was quashed by cassation 16-937/2020 without ruling on classification

City cameras

used by the Interior Ministry for public safety: 2nd CCGJ 31.07.2020 No. 88a-17020/2020, Moscow City Court 30.01.2020 No. 33a-707/2020

Private cameras

do not cover the claimants' plot and cannot reliably identify persons: Supreme Court of the Komi Republic 04.02.2019 No. 33-640/2019

Phone filming

the recording cannot identify the data subject: 4th CCGJ 16.10.2020 No. 16-894/2020

Clinic cameras

the footage was shown to a visitor to find his phone: 8th CCGJ 19.12.2019 No. 88-1005/2019

House camera

not aimed at the claimant's flat and serves the owner's security: Kirovsky District Court of Saratov 01.06.2021 No. 2-2354/2021

State body archive

pre-transfer recordings, Nizhny Novgorod Regional Court 19.12.2018 No. 33a-15421/2018

Sleeping employee

image before transfer for identification: Kineshma City Court 27.05.2021 No. 2-873/2021

Lesson recording

for discipline, no portrait shots, deleted after class: Knyazhpogostsky District Court 04.02.2025 No. 12-3/2025

Liveness check

video check of an Avito profile owner does not serve identification: Ryazan Regional Court 11.03.2026 No. 33-342/2026

Prints at an energy site

allowed without consent under counter-terrorism requirements, Art. 11(2): 7th CCGJ 01.08.2023 No. 88-10266/2023

Why biometrics

Named photos for pass cards

classification rested on Supreme Court ruling 05.03.2018 No. 307-KG18-101 and Ministry of Digital Development letter 17.07.2020 No. OP-P24-070-19433. Neither the management company nor the training centre had written parental consent

the organisation was fined ₽30,000 in a separate ruling (5-276/2022), the court rejected replacing it with a warning

suspension and bonus loss did not clear the responsible person

the "old management company's computer" argument was rejected

• 1
• 02.10.2021: photo storage

170 photos of computer centre students with full names stored on the Zelenograd business centre administrators' computers

• 2
• 20.01.2022: inspection

Zelenograd district prosecutor's office, on a citizen's complaint, with FSB and Rosgvardia officers; the files were deleted minutes after the inspection

• 3
• 19.04.2022: fine

a magistrate fined the senior administrator, responsible for PD when issuing access cards, under Art. 13.11(2) of the CAO

• 4
• 23.06.2022: decision upheld

Zelenograd District Court upheld the fine and rejected a warning instead and insignificance of the offence

vs

Biometrics

Treated as biometrics

02.10.2023, RKN regional offices: fingerprints and pass photos when used in ACS

28.12.2023, Digital Ministry No. P24-2-04-070-257558: a face intercom that authenticates falls under Law 572-FZ

13.03.2024, Astrakhan Region office: matching a pass photo with its bearer

15.10.2025, Digital Ministry No. P24-16856-OG: fingerprints in ACS, though Law 572-FZ does not cover them

06.03.2026, Digital Ministry: building sites need the UBS or accredited systems, plus consent

General regime

Narrow the regime or waive consent

23.04.2024, RKN No. 08-128904: photo in ACS is biometrics on the 572-FZ approach, only Art. 3(4) data in ACS

01.08.2024, Central FD office No. 62450-02-11/77: only if a regulation says so directly, otherwise Art. 6

06.03.2026, RKN No. 08-166570: building sites without consent under Art. 11(2)

14.08.2026, open day: a face in ACS outside Art. 13 of Law 572-FZ is not biometrics, nor is a vector without identification

In practice: the 2026 position is oral and contradicts the practice in case A42-342/2017: until confirmed in writing, keep written consent and a non-biometric route

1

Image capture

a scanner or camera obtains a biometric sample

2

Feature extraction

quality control, segmentation, extraction of patterns and minutiae

3

Template or vector

mathematical conversion into digital form such as 10010011

4

Comparison

1-to-1 check against a reference or 1-to-n search

5

Decision

the match score is compared with a threshold for a yes or no

Legal status

A vector remains PD

Art. 2(3) of Law 572-FZ: PD obtained by mathematical conversion of biometric PD. Purpose, legal basis, retention periods and data subject rights apply to it

UBS vectors are exempt from Art. 11 and Art. 19 measures of Law 152-FZ (Art. 3(5) of Law 572-FZ), but the general PD regime stays

vector conversion is not depersonalisation, and the non-restorability of the source image does not decide the regime

for UBS identification the match threshold is at least 0.9999 (Digital Ministry order of 17.04.2023 No. 378)

01

Capture

the scanner receives a biometric presentation and asks for a repeat if quality is low

02

Signal processing

quality check, segmentation, feature extraction, template creation

03

Storage

enrolment database with reference templates

04

Comparison

matching a new template with the database, computing the score

05

Decision

threshold and rules: match in verification, candidate in identification

Three processes run through the subsystems

• biometric enrolment
• biometric verification
• biometric identification

For lawyers: creating a sample database is a legal decision: it is the storage and comparison subsystem that turns images into biometrics

152-FZ

Manual processing

an authorised official makes the comparison, with real control over the decision

Art. 11(1) regime in full, including written consent

a lawful exit from the UBS scope while still identifying people

cost: manual labour and reliance on staff skill

Law 572-FZ

Automated processing

an information system compares the face image or voice recording

identification only via the UBS

authentication via the UBS, a regional segment or an accredited organisation, using vectors

Art. 11 of Law 152-FZ applies on top

Art. 1 exemptions of Law 572-FZ

The Law does not apply to

operational-search, counterintelligence and intelligence activity

defence, state security, public order, foreign policy

migration and registration records, handling of identity documents

sanitary and epidemiological well-being

Do not mix up: Art. 1 exemptions of Law 572-FZ differ from Art. 11(2) of Law 152-FZ: the first take you out of the infrastructure law, the second waive consent

01

Art. 11(1) of Law 152-FZ

Establishing identity

the PD law's generic concept. No cross-sector definition or universal procedure exists, so it is unclear which actions qualify

02

Art. 2(6), (7) of Law 572-FZ

Identification: who is it?

identity established by finding information about a person, verifying it and matching it to an identifier

03

Art. 2(2) of Law 572-FZ

Authentication: is it you?

verifying that identifiers belong to a person by matching them with the verifier's data, after which the person counts as identified

Subtlety: Law 572-FZ separates the operations by the object established, not by the number of records compared: authentication allows 1-to-1 and 1-to-n

• Aspect
• Was, Law 149-FZ
• Now, Law 572-FZ

• Capture
• banks collect biometrics into the UBS at the citizen's option; data held in CBS goes to the UBS
• same; face and voice import from CBS and others into the UBS until 30.09.2023

• Storage in CBS
• biometrics may be stored in CBS and the UBS
• primary biometrics only in the UBS; CBS holds UBS vectors and authentication data up to 10 days, no passing vectors to third parties

• CBS services
• biometric identification and authentication
• identification only via the UBS and ESIA, authentication only by UBS vectors, banned cases in Gov. Res. No. 815

• CBS accreditation
• against set requirements from 01.03.2023
• from 01.06.2023, transition to 01.12.2023, GIS-level protection from 01.01.2025

• Consents
• collect and process only with consent
• plus consent to send a vector to a CBS, opt-out of collection via MFC, consent management on Gosuslugi from 01.01.2024

app or import

Simplified

registration in the "Gosuslugi Biometrics" app with a confirmed Gosuslugi account: transport, office entry, simple services

valid for 2-3 years

purchases up to ₽2,500

limited list of services

app with NFC

Standard

needs a chip travel passport, NFC phone and confirmed account: Gosuslugi login, entry, transport, SIM card

valid for 2-3 years

purchases up to ₽5,000

limited list of services

in person at a bank

Confirmed

access to all biometric services: passport replacement, remote banking, enhanced qualified signature

valid for 5 years

purchases up to ₽5,000

unlimited list of services

New: under the 2026 procedure changes a citizen may place both types of biometrics in the UBS or only one, so some users have just a face or just a voice

• Site and task
• Operation
• Via the UBS
• Via CBS

• Important sites, Art. 13(1). Defence industry, nuclear sector, chemicals, energy, transport infrastructure, CII subjects, high terrorism-risk and restricted sites
• identification and authentication
• yes
• no

• Own staff, Art. 13(3). State bodies and CII subjects that are themselves accredited, on their own premises
• authentication
• yes
• yes

• Other organisations, Art. 13(2). Entry of staff and visitors
• authentication
• yes
• by vectors

• 8 groups, Gov. Res. No. 815. Exams, telemedicine, prescription drugs, public services and GIS, medical checks and others
• authentication
• yes
• no

Pending: bill No. 1131094-8 of 24.01.2026 would let important sites use their own accredited owner's systems for staff and visitors, but is not yet adopted

The UBS stores a face image and a voice recording. Identification via ESIA and the UBS equals presenting a passport, except where the law requires the original document

vs

Transactional

Each match runs in the UBS

the organisation queries the UBS and ESIA on each client contact

identification, authentication available

references stay in the UBS, the organisation gets only the result

a fee for each successful comparison

Vector

Comparison in an accredited system

UBS vectors go to an accredited organisation's CBS

only authentication is available

six Art. 16 conditions of Law 572-FZ, incl. accreditation

a fee for vector transfer

Identification: establish identity and create a profile

1

Client request

a person seeks to be a client

2

Data request

organisation asks UBS and ESIA about the citizen

3

System response

this is I.I. Ivanov, passport and other data

4

Service

a client profile is created

Authentication: confirm that the profile owner has applied

1

Service request

the client wants to log in

2

Comparison

photo sent to the UBS: id 42? (1-to-1) or who? (1-to-n)

3

UBS response

yes, it is id 42, or id 63

4

Service delivery

access to the account

Remember: before authentication the client database with identifiers is uploaded to ESIA, a separate act of PD processing

Art. 16(3) conditions of Law 572-FZ are cumulative: miss one and vector authentication is unavailable

• 1
• measures, Art. 19(4) of Law 152-FZ

• 2
• cryptographic tools against threats set by authorised bodies

• 3
• requirements for collecting biometric PD

• 4
• requirements of Law 572-FZ and CII security legislation

• 5
• the individual's consent, managed via ESIA

• 6
• accreditation under Art. 17 of Law 572-FZ

no accreditation, path 1

Stop the old regime

biometric services outside Law 572-FZ bring liability under Art. 13.11.3 of the CAO

path 2

Work via the UBS

use the UBS GIS identification and authentication services

path 3

Contract with accredited firm

no accreditation of its own is needed without its own biometric system

Participant filter: organisation not on extremist and terrorist lists, head without a criminal record, no unreliability note in the company register; in the vector model the accredited organisation checks

₽500m

own funds

organisation's capital

₽100m

financial security

liability for losses

49%

foreign participation

cap on equity share

3 years

no revocation

of accreditation early

databases only in Russia

connection to GosSOPKA

FSB licence if cryptography is not only for own needs

owned hardware encryption tools

two staff with higher IT education

consent to disclosure of tax secrecy

no unreliable-data note in register

Sole executive body

Russian citizenship, business reputation

not on extremist and terrorist lists

no unexpunged or outstanding conviction

5 years free of secrecy-breach penalties

3 years not heading an organisation with revoked accreditation

• Category, fee per successful comparison incl. VAT
• Coef.
• 1-500 a day
• 501-1000
• from 1,001

• Identification, all user categories
• 1
• 60 ₽
• 45 ₽
• 30 ₽

• Authentication: site entry, cashless payments in retail and services, taxes and fees
• 0,14
• 2,80 ₽
• 2,10 ₽
• 1,40 ₽

• Authentication of long-distance and suburban train passengers
• 0,5
• 10 ₽
• 7,50 ₽
• 5 ₽

• Authentication: age for alcohol and tobacco sales, prescription drugs, other categories
• 1
• 20 ₽
• 15 ₽
• 10 ₽

• Joint biometrics promotion events agreed with the UBS operator
• 0
• 0
• 0
• 0

Monthly packages: identification ₽285,000 for 10k, ₽810,000 for 30k and ₽2,550,000 for 100k successful comparisons; authentication at coefficient 1 - ₽95,000, ₽270,000 and ₽850,000

Note: the methodology applies until 01.06.2029, state bodies and the Bank of Russia are exempt, and the 2026 bill's estimate puts a UBS entry at ₽2.8 with a ₽30 annual fee per vector

2022-2024: launch

29.12.2022

Law 572-FZ adopted

main part in force from publication

01.06.2023

Arts 13-18

Art. 15 bans, entry, accreditation, vector model, oversight

30.09.2023

Import closed

window for moving old biometrics to the UBS closed

01.01.2024

Gosuslugi

view and withdraw all consents in a single window

01.09.2024

Government decides the types

Res. No. 408: face and voice to 01.09.2027

2025-2029: rebuild

01.01.2025

CBS protection

GIS-level system requirements

2026

Pending

bill on Art. 13; media say microlenders expect face identification

01.01.2027

Regions and signature

vector segments, end of interim e-signature

01.09.2027

List of types

Gov. Res. No. 408 expires, types to be redefined

01.06.2029

Tariffs

the query fee methodology expires

Definitions

Identification, Art. 2(7), 572-FZ

a set of measures to establish information about a person, verify it and match it with an identifier

identifier: a unique designation of a person's data used to single them out (Art. 2(6) of Law 572-FZ)

per GOST ISO/IEC 2382-37-2016: searching enrolments and returning one individual's template identifier

Algorithm

getting a person's data from ESIA and the UBS in the transactional model

Ban on own system

Art. 15 of Law 572-FZ bans organisations from processing, collecting and storing biometrics for identification, other than collecting for the UBS

Statutory threshold

a match score of at least 0.9999 is set by Digital Ministry order No. 378, not by user settings

Weight of the result

identification via the UBS and ESIA equals presenting a passport (Art. 11 of Law 572-FZ)

Initial collection

original face and voice are collected by banks, MFCs and authorised organisations or by the citizen via the app

If the technical process implemented in an intercom service matches the definition of authentication, organisations providing such a service must comply with the requirements of Federal Law No. 572-FZ

Ministry of Digital Development, letter of 28.12.2023 No. P24-2-04-070-257558

Authentication, Art. 2(2), 572-FZ

• 1
• verifying that identifiers belong to a person by matching them with the verifier's data

• 2
• 1-to-n search or 1-to-1 check in ESIA and UBS, or in CBS by vectors

Verification per GOST

confirming a biometric claim by comparison, GOST ISO/IEC 2382-37-2016 para. 37.08.03

Conclusion: face intercoms and entry are authentication: only via the UBS or its vectors in an accredited system; an own face template base is banned by Art. 15 of Law 572-FZ

01

general category

Non-biometric processing

photo and visitor details on the pass

an authorised person checks the photo against the face and decides

Legal basis: Art. 6(1) of Law 152-FZ, no UBS

02

general or biometrics

Matching on a monitor

photo in ACS, visitor taps an ID card

ACS shows the photo to an operator, who compares and decides

Legal basis: Art. 6(1) or Art. 11 of Law 152-FZ, no UBS

03

biometrics

Biometric authentication

vector and ID card in ACS

a sensor reads the face, ACS compares it with the card template and decides unaided

Legal basis: only UBS vectors (Art. 15(1), Art. 16(1), (3) of Law 572-FZ)

04

biometrics

Database search, decision

templates of all visitors in ACS

a sensor reads the face, ACS searches its own database and decides

Legal basis: own templates banned by Art. 15, Law 572-FZ; only the UBS or its vectors

Debatable: RKN said orally on 14.08.2026 that a photo in ACS is biometrics only within Art. 13 of Law 572-FZ, whereas courts in case A42-342/2017 treated manual matching as biometrics too

• Establishing identity
• Without biometric recognition

no comparison, or a person makes it

With biometric recognition

automatic comparison by the system

Identity not established

• 1
• Art. 6(1) of Law 152-FZ

video security and production control, shelf photos, tags on uniforms and gear

• 2
• Art. 6(1), the most vulnerable cell

unique visitor counts, PPE checks, crowd threats, video-call transcripts by voice, driver fatigue

• Non-biometric identification
• 3
• Art. 6(1) of Law 152-FZ

a guard compares the pass photo, video discipline control, manual liveness check of a profile owner

• 4
• Art. 6(1), a disputed cell

auto-matching a selfie with a passport, liveness and age checks, FaceID on the user's device

• Biometric identification
• 5
• Art. 11 only, no 572-FZ

an official looks for a wrongdoer using camera recordings and existing samples

• 6
• Art. 11 and Law 572-FZ

call-centre authentication, face fare payment, car sharing via the UBS, ACS fingerprint under Art. 11 only

Trap: matching against a fraudster database and collecting non-clients' face and voice biometrics create an own system banned by Art. 15 of Law 572-FZ; other modalities have neither a basis nor consent

• 1
• Closed UBS list

from 01.09.2024 the Government sets the types: face and voice (Gov. Res. No. 408 to 01.09.2027); genome is banned in the UBS; prints, veins and iris stay under Art. 11

• 2
• Russia only

identification and authentication involving CBT are banned (Art. 3(21) of Law 572-FZ); foreign recognition clouds like AWS Rekognition and Azure Face are closed

• 3
• Own identification banned

own face and voice identification is banned (Art. 15 of Law 572-FZ); authentication only by UBS vectors, with accreditation, cryptography and an FSB licence

• 4
• Special consent regime

separate written consent for a specific operator, withdrawable at any time; refusal is no reason to deny the service or worsen its terms

• 5
• Minors

Digital Ministry deemed students' biometrics in school ACS inadmissible; a legal representative's consent does not replace the subject's own

• 6
• Accuracy limits

FAR and FRR are never zero; quality drops with age, injuries and poor capture, so disputed matches are built into the product design

• 7
• No raw biometrics

the UBS returns a vector and a match score, not an image, which limits further training of own models; authentication data is kept up to 10 days

Irreversible leak

biometrics cannot be reissued like a password: a compromised template stays vulnerable for life and across all systems

Fines and criminal risk

biometrics leak ₽15-20m, repeat 1-3% of revenue (min. ₽25m), UBS violations up to ₽2m, Art. 272.1(2) of the Criminal Code up to 5 years

Model bias

per NIST FRVT, recognition accuracy differs across demographic groups, a ground for complaints and inspections

Presentation attacks

masks, photos, video, deepfakes, voice synthesis and in-channel frame swaps require layered liveness checks

Function creep

ACS get used to assess performance without a legal basis, against purpose limitation and minimisation (Art. 5 of Law 152-FZ)

Reputation

face recognition in the metro and biometrics in schools show any biometric initiative is under a media microscope

Inspections

prosecutor inspections with the FSB and Rosgvardia lead to fines and data deletion, as in the 2022 Savelkinsky Proezd case

Architecture and data

avoid biometrics if a card, PIN or OTP achieves the aim: it is not a default choice

process on the device: the image stays on the phone or terminal, the operator gets only yes or no

store templates instead of source images, encrypt, rotate keys, destroy with an auto-delete tool

choose the UBS route: own accreditation or a contract with an organisation on the ebs.ru list

certified algorithms and liveness checks, regular FAR, FRR and deepfake resistance tests

Processes and compliance

before launch assess necessity, proportionality, alternatives and harm to data subjects

take separate written consent for each purpose and keep a non-biometric alternative on equal terms

keep logs of consents and withdrawals, notify RKN of a leak within 24 and 72 hours

record purposes and assess each new use of biometrics to avoid function creep

destroy biometrics of leavers and consent withdrawals when it happens, not at inventory

Transparency: explain to users in plain language which features are captured, why, where they are stored and how to delete them, especially for behavioural biometrics

• Situation
• Basis
• Limit

• Rule requires cameras
• Art. 6(1)(2): mass-gathering sites (Gov. Res. No. 272), all hotels (No. 447), healthcare category 3 and up (No. 8)
• fitting settled; access, release not

• Visitors
• legitimate interest, Art. 6(1)(7), given a specific task and expectations
• check for a milder way, disputed

• Employees
• entry security or workplace control, Art. 86(1) Labour Code
• Labour Code Art. 214.2 only for work safety

• Citizen and block of flats
• personal needs (Art. 1(2)) or a meeting decision (88-100/2019)
• viewing a neighbour voids the exemption

No-camera zones

per the expert approach: fitting and changing rooms, toilets, a doctor's examination room, spots revealing health or beliefs

court excluded a rest and meal room though the order was unchallenged (88-14171/2023)

Frame, not floor plan

in neighbour disputes a view no wider than an ordinary observer's was not held to be PD processing (33-640/2019, 88-235/2021)

the sector is proved by expert report (88-6070/2023) and frame export (2-177/2022)

sound, per the expert approach, is justified separately

427-FZ, Art. 10(3), from 01.09.2026

Information before entry

for guarded sites with video surveillance, people are informed before entry, in a place visible day and night, with regime conditions and access rules; the operator's PD duty stays

• Parameter
• Employee
• Visitor

• Timing
• before surveillance starts, a newcomer on hiring
• before entering the zone

• Content
• fact, purpose and camera coverage
• fact, purpose, and regime terms if guarded

• Form
• signed internal regulation, employment contract, signs
• sign and processing policy

1

Decision

order with start date, purpose and owner

2

Internal regulation

purposes, points, content, access, term, transfer, failure

3

Information

acknowledgement sheet, signs, policy section

4

Supporting set

PD and PDIS lists, security instruction

Practice: for open surveillance courts accepted an order, camera map and acknowledgement sheet (33-653/2019) or an order, regulation and personal employee notice (33-20507/2016); paperwork does not cure covert surveillance

30 days

hotels

continuous-recording archive, Res. No. 447

1 month

medicine and science

Gov. Res. No. 8 for cat. 3+, No. 1421 for cat. 1-2

6 months

destruction limit

of a blocked data set, unless the law says otherwise (Art. 21(6))

• 1
• Fix the term in advance

by purpose in an internal act, checked against recorder depth

• 2
• Export the clip

on an incident before overwrite, noting the export time

• 3
• Give the clip its own term

until proceedings end, or copies live on in mail for years

• 4
• Close the unextractable set

block and destroy in full

Two-layer access

the post sees live video but cannot export the archive

the admin maintains the system with no access to recordings

every archive access is logged

access leading to copying, blocking, modification or destruction risks Arts 272, 272.1 of the Criminal Code

In a court dispute

audio and video are evidence (Art. 55(1) Civil Procedure Code, Art. 26.7 CAO); admissibility is assessed case by case

viewing held lawful where it confirmed an already found, uncontested fact (33-50244/2018); the Labour Code Art. 86(6) plea was rejected in 33-8775/2018

Expert approach

trawling the archive for grounds, or deciding on one export, is weaker

a recording in breach of rules loses weight and can lead to a moral harm claim (Law 152-FZ Art. 24, Labour Code Art. 237)

Release to a body, Art. 13(1)(4) Police Law

• 1
• Basis and authority

request rule and requester's authority

• 2
• Form of request

the request is drawn up as the rule requires

• 3
• Scope

a clip for the request's subject, not a period archive

• 4
• Recording

who got what and when

Access: under Art. 14 the subject is given surveillance data, a refusal cites the rule (Art. 14(8)), though a court found no duty to show an employee an entry recording (88-19944/2023). Outsiders are masked in external releases, e.g. to the media

1

Stream

faces in frame without matching, ordinary PD with a surveillance basis

2

Archive

a recording gains time and links, needs term, content and retention basis

3

Establishing identity

matching by frame triggers Art. 11, while seizure and comparison without it do not (2a-577/19)

• Event
• How it is classified
• What to do

• Recognition switched on
• per the expert approach, changes the regime of the whole set if it serves to establish identity
• record the feature date; review the basis, measures and notice

• Archive search for a culprit
• per the expert approach this is Art. 11; RKN orally (22.10.2025, 14.08.2026) sees biometrics only under the biometrics law
• obtain consent to the investigation purpose in advance

• Recording handed to police
• the police may establish identity without consent (Art. 11(2), Art. 13(1) of the Police Law, Supreme Court 15.05.2025)
• per expert view the operator holds no biometrics; recording basis and term stay with it

Example: 7th CCGJ 24.07.2020 sent back for retrial a school's appeal against a ₽25k fine under Art. 13.11(5) of the CAO: the parental consent argument was not assessed, lawfulness was not decided (16-2185/2020)

01

Purpose triggers the regime

the three Art. 11 features work together: no identification purpose means a photo is ordinary PD; GOST format is irrelevant

02

Face and voice within the UBS

identification only via the UBS, authentication only by its vectors with accreditation, other modalities fall under Art. 11

03

Consent separate and free

from 01.09.2025 a separate document, no penalty for refusing; denying a contract is punishable (Art. 14.8(8) CAO)

04

ACS remains a disputed zone

RKN narrowed biometrics to Law 572-FZ Art. 13 in 2026, courts and the Digital Ministry are wider: keep consent and a non-biometric route

05

2027 is the rebuild point

regional vector segments, end of the transitional simple e-signature, and a new list of biometric types from 01.09.2027

06

Antifraud, no outside biometrics

a fraudster database by face and voice is not allowed, build it on non-biometric features