KosovoLaw No. 06/L-082 on Protection of Personal Data, use of biometric characteristics
Law No. 06/L-082 on Protection of Personal Data, arts. 80-83 (use of biometric characteristics)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 12 March 2019.
A biometric privacy rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Before determining, using or comparing a data subject's biometric characteristics to identify them, confirm this chapter's dedicated rules apply rather than the law's general processing rules alone.
- In the public sector, use biometric characteristics only where strictly necessary for the safety of individuals, the protection of property, or safeguarding confidential data and trade secrets, and only where no easier means would achieve that purpose.
- In the private sector, apply the same necessity test, inform employees in writing in advance of the measures and their rights, and submit a detailed description of the proposed measures to the Agency for Information and Privacy before taking them.
- Do not implement a private-sector biometric measure until the Agency has authorised it, which the Agency must decide within thirty days of receiving your submission.
- Where biometric characteristics are used for access control in the public sector, apply the entry and exit records chapter's retention and handling safeguards to that use.
What it reaches
Obligation class
Biometric, Consent, Licensing
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 80 subjects the determination and use of a data subject's biometric characteristics, and their comparison to enable identification, to this chapter's dedicated rules. Article 81 lets the public sector use biometric characteristics only where strictly necessary for the safety of individuals, the protection of property or the safeguarding of confidential data and trade secrets, and only where that cannot be achieved by other means.
Article 82 lets the public sector use biometric characteristics for access control, applying the entry and exit records chapter's retention and handling rules to that use. Article 83 lets the private sector use biometric characteristics under the same necessity test, requires employees to be informed in writing in advance of the measures and their rights, and requires the controller to submit a detailed description of the proposed measures to the Agency before taking them.
Article 83(3) gives the Agency thirty days to decide whether the proposed measures comply with the law. Article 83(4) lets the controller implement biometric measures only after receiving the Agency's authorisation.
Whether a voiceprint falls inside these biometric-use rules is not established by the law's own text: the general biometric-data definition's core clause covers behavioural characteristics used for unique identification, but its illustrative list of examples names fingerprints, iris, retina, facial features and DNA and does not name voice.
When LexLint raises it
processes_biometrics
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.