A Bunch of Government Decrees Regulating the Functioning of the Unified Biometric System Came into Force.

On June 15 and 16, 2022 three Government Decrees came into force, regulating the processing of personal biometric data by individuals in the unified biometric information system of personal data.

According to the Decree of the Government of the Russian Federation No. 451 of June 8, 2011 the unified biometric system (UBS) is an element of infrastructure ensuring information and technological interaction between existing and newly created information systems used to provide state and municipal services and to perform state and municipal functions in electronic form.

Decree No. 1089 of the Government of the Russian Federation of June 16, 2022

Specifies the purposes and functions of the UBS. Thus, the UBS is used for the identification and authentication of an individual by the state authorities, credit organizations, non-credit organizations, financial institutions and other organizations, individual entrepreneurs and notaries with the use of biometric personal data of an individual.

UBS is intended to solve the following tasks¹:

• Processing by state bodies, banks and other organizations of biometric personal data of an individual in the unified information system of personal data, including processing (collection and storage), verification and transfer the provided biometric personal data of an individual;
• Processing by individuals of their biometric personal data using the Russian software functioning with the use of encryption means;
• Verification of the individual's biometric personal data;
• Submission of data to information systems, whose owners are accredited organizations;
• Provision of information, which is the result of biometric personal data processing, to the authorized state bodies, etc.

This Decree also establishes the functions of the UBS operator², including ensuring technical functioning of the UBS, information protection, consulting functions and provision and destruction of biometric personal data upon the motivated request of the federal executive authorities and other functions necessary for the UBS operation.

In addition, the Decree prohibits the placement and processing of information considered a state secret in the UBS³.

Biometric personal data in the UBS is signed by an enhanced qualified electronic signature of the state body or organization that places the data⁴.

UBS interacts with the following information systems⁵:

• The unified portal of state and municipal services;
• Unified system of identification and authentication;
• The unified system of inter-agency electronic interaction.

This Decree came into force on June 17, except for the provision of data to information systems, the owners of which are accredited organizations, which will come into force on September 1, 2022.

Decree of the Government of the Russian Federation of June 15, 2022 No. 1066

It establishes the procedure for placing biometric data by individuals in the UBS and a number of tasks for the Ministry of Digital Development, the UBS operator and the Federal Security Service of the Russian Federation.

Individuals themselves ensure the safety and non-disclosure of information related to the use of mobile applications, including passwords, logins from the phone and used apps.

1. In order to place the data in the UBS it is necessary to register the account of an individual in the federal state unified system of identification and authentication⁶.

2.The UBS operator carries out an automatic check, after which the individual initiates the process of submitting biometric personal data to the UBS⁷.

3.Individual should give his/her consent to the processing of his/her biometric personal data in the UBS. The individual has the right to sign the consent with a simple electronic signature, the key of which is obtaining upon personal appearance when providing state and municipal services⁸ .

4.A natural person independently collects biometric personal data, followed by the creation of biometric samples of facial and voice image data⁹.

5.After the biometric data is uploaded to the mobile application, it is automatically transferred to the UBS, where it is checked for compliance with the requirements for the samples.

6.If the biometric personal data does not comply with the pattern requirements, the data is uploaded to the UBS, and the person should be notified by e-mail.

7.The UBS operator confirms the identity of an individual who places biometric personal data in the UBS using an identity document of a citizen of the Russian Federation outside the Russian Federation, as well as verifying that the passport holder's personal data correspond to information placed in the unified identification and authentication system¹⁰.

The above Resolution came into force on June 17, except for the procedure of placing biometric data in the UBS by individuals, which will be approved on September 30, 2022.

Decree of the Government of the Russian Federation No. 1067 dated June 15, 2022

It establishes the cases and terms of using biometric personal data placed by individuals in the Unified Information System of Personal Data.

Thus, biometric personal data placed in the UBS may be used in the following cases¹¹:

• Attestation for educational programs of higher education (bachelor's, specialist, master's);
• Operations with the use of payment cards in trade and service organizations in the amount not exceeding 1 000 rubles;
• Implementation by credit organizations and non-credit financial organizations, subjects of the national payment system of additional authentication of the client - natural person at his remote service;
• Authentication of the client-individual in person by financial market organizations;
• Implementation of payment for travel using information technologies of Moscow;
• Implementation of access to the territory of public authorities and organizations through the system of access control and management in the territory of these bodies and organizations;
• Conclusion of contracts for the provision of Internet communications services;
• Ensuring the issuance of personalized cards for attending sporting events;
• Authentication on the state platform «Unified portal of state and municipal services».

The list is closed, but due to the active implementation of remote authentication and identification technologies, it is assumed that this list can be expanded.

Biometric personal data is stored in the UBS for 3 years and can be voluntarily updated by an individual¹².

Decree No. 1067 of the Government of the Russian Federation dated June 15, 2022 will come into force on March 1, 2023 and will be valid until March 1, 2029.

¹ Par. 4 of the Decree of the Government of the Russian Federation of 16.06.2022 № 1089
² Par. 6 of the Decree of the Government of the Russian Federation of 16.06.2022 № 1089
³ Par. 11 of the Decree of the Government of the Russian Federation of 16.06.2022 № 1089
⁴ Par. 13 of the Decree of the Government of the Russian Federation of 16.06.2022 № 1089
⁵ Par. 18 of the Decree of the Government of the Russian Federation of 16.06.2022 № 1089
⁶ Par. 3 of the Decree of the Government of the Russian Federation of 15.06.2022 № 1066
⁷ Par. 4 of the Decree of the Government of the Russian Federation of 15.06.2022 № 1066
⁸ Par. 6 of the Decree of the Government of the Russian Federation of 15.06.2022 № 1066
⁹ Par. 7 of the Decree of the Government of the Russian Federation of 15.06.2022 № 1066
¹⁰ Par. 11 of the Decree of the Government of the Russian Federation of 15.06.2022 № 1066
¹¹ Par. 1 of the Decree of the Government of the Russian Federation of 15.06.2022 № 1067
¹² Par. 2,3 of the Decree of the Government of the Russian Federation of 15.06.2022 № 1067