About this service
A facial image, a fingerprint, a voice characteristic, an iris pattern — biometric data is the strongest means of identifying a person and at the same time one of the most sensitive categories of data. A leak of biometrics cannot be fixed by changing a password: biometrics accompanies a person for life. That is precisely why the Georgian law on personal data protection places biometric data in the special-category regime and subjects its processing to special conditions. This service helps organisations that use — or plan to use — biometrics, from access control to customer verification.
What biometric data is
Article 3 of the law gives a precise definition: biometric data is data processed by technical means, connected to the data subject's physical, physiological or behavioural characteristics, which gives the possibility of the subject's unique identification or confirmation of identity. Two elements are decisive here: technical processing and the possibility of unique identification. A photograph merely stored in an archive is not ordinarily biometric data; the same photograph used by an algorithm to recognise a person already falls under the biometric regime. Biometric data enters the list of special categories where the purpose is unique identification — a classification with immediate practical consequences.
When biometric processing is permitted
Article 9 of the law establishes the rule of permission. Biometric data may be processed only in defined cases: where it is necessary for the purposes of conducting activities, security, the protection of property and the prevention of disclosure of secret information, and where achieving these purposes by other means is impossible or requires disproportionately great effort — biometrics must thus be the last resort, not the first choice. Beyond that, processing is permitted for the purposes of issuing identity documents in the manner established by law, identifying a person crossing the state border, combating unlawful migration, preventing and investigating crime, operational-search activity and other defined purposes. The list is closed: using biometrics „because it is convenient“ is not a lawful basis.