Within the framework of the project, unified rules for working with biometric data are established, which must be adhered to in state digital resources, and requirements for information carriers and the technologies for their storage outside these resources are defined.
The government emphasizes that biometric data can be used solely for the identification of specific citizens during elections, referendums, and the provision of public services. At the same time, mass matching of data with the general database is strictly prohibited.
Significant attention in the project is given to cybersecurity issues. The mandatory use of certified protection measures is introduced, along with the maintenance of digital logs of all actions with the data and an annual risk assessment for agencies that have access to biometric information. Rules for employees are also outlined, including the necessity of registration in the digital service and the implementation of multi-factor authentication.
The conditions for the transfer and backup storage of biometric data are becoming stricter. All physical carriers must be encrypted, accounted for, and sealed, and in the case of loss of the need for storage, they must be destroyed based on an act. The transfer of such carriers is permitted only if there is no technical possibility for sending data through secure channels.
Additionally, the draft resolution cancels a number of regulatory acts adopted in 2014, 2018, 2020, 2022, and 2024 concerning biometrics, as they no longer comply with the requirements of the new digital regulation.
