Ukraine needs to unify biometrics legislation to align with EU

Ukraine is considering introducing a comprehensive law to establish unified rules for the collection, use, storage, access and oversight of biometric data, bringing its framework into alignment with EU privacy and interoperability standards.

The move is driven in part by a parliamentary study that analyzed Ukrainian legislation, European Union approaches, Council of Europe documents, and European Commission recommendations as part of the negotiation process for Ukraine’s accession to the EU, according to Sud.ua.

Fragmentation within regulatory frameworks remains a key problem. While biometric data is classified as personal information, “current regulations contain different approaches to their definition and lists.” Categories that “limit state accounting to digitized facial images and fingerprints” do not align with international standards, which “cover a much wider range of physiological and behavioral human characteristics.”

Per the study, “such terminological inconsistency creates risks of uneven law enforcement and complicates the harmonization of national legislation with the EU.”

In other words, if it wants into the EU, Ukraine needs to regulate more biometric modalities and approaches than face and fingerprint.

No unified legislative regime for state biometric systems

Researchers call out the need for a new law specifically covering biometrics. A framework is required to bring together governance that is currently “scattered among laws and numerous subordinate acts, which does not ensure an adequate level of legal certainty.”

This law would consist of “a unified legal regime for state biometric systems, a unified conceptual framework, exhaustive processing purposes, access rules, storage periods, human rights guarantees, mechanisms for independent and parliamentary control, as well as requirements for security and interoperability of such systems in accordance with GDPR standards.”

Other legislative improvements on the table include harmonized language and terminology, and clear lines around grounds and purposes for biometric data processing. Data protection impact assessments should be mandatory, and parties should be subject to independent audit and supervision. Data retention and storage limits should be uniform. And there should be regulation of automated facial recognition, with special rules for law enforcement and security sectors.

The overarching goal is “the formation of a comprehensive, transparent, and accountable system of state accounting and use of biometric data that will ensure a balance between the needs of national security, the state’s digital transformation, and proper protection of human rights and freedoms in accordance with European standards.”

EUDI Wallet, UK also facing interoperability question

The question of fragmentary governance, however, is not unique to Ukraine. As the EU moves to implement its EUDI Wallet scheme across member states, there are still unanswered questions about how everything will work together.

This problem extends to the UK, where the digital identity industry is asking what rules to expect around interoperability with the EUDI Wallet.

Ukraine may be slightly behind the curve in bringing its biometrics and identity laws in line with the EU’s, but the issue of interoperability is a global one, provided any country wants its digital ID to be recognized outside its issuing territory.

It is also, arguably, equivalent to the problem of adoption. More clarity on how, where and when digital ID will work can drive more use cases, which will increase adoption.

In Ukraine, the appetite for digital ID and biometric authentication is there: a recent Visa study found that nine out of 10 Ukrainians would be open to frequently engaging in online trade transactions, provided if the payment method available to them is secure.

Article Topics

biometric data  |  biometrics  |  data protection  |  data storage  |  Europe  |  interoperability  |  legislation  |  Ukraine