Law on Personal Data Protection, biometric and location data protection

Article 31 defines biometric data as data on physical attributes and unique and stable biological characteristics of a person used to identify that person, and requires an organization, agency, or individual collecting or processing biometric data to apply physical security measures for storage and transmission devices, limit access, maintain a monitoring system to detect infringement, and comply with relevant laws and international standards; a processor causing damage through biometric-data processing is liable.

Unlike every other jurisdiction in this research batch, Article 31 names no facial, voice, or fingerprint example at all, resting entirely on the general physical-attribute language; whether the definition excludes an identifier derived from a photo, video, or audio recording is accordingly recorded as unresolved rather than confirmed either way.

This provision functions as heightened, category-wide protection rather than a named consent-at-capture rule distinct from the Law's general Article 8 consent duty, which was not read verbatim this pass.