Cybersecurity Policy Report, Opinion on Processing of Biometric Data Released in Slovenia, (Jul 16, 2026)

By Tony Foley

Responding to a request on the need to assess the processing of biometric data of users of mobile applications, the Slovenian Information Commission issued an opinion noting that the country’s data protection law allowed for such processing, provided that specified conditions are met.

The opinion, issued yesterday, notes that the party requesting the opinion planned to facilitate the processing of biometric data by a third party as a contractual processor for the purpose of protecting the accuracy of a customer’s identity. The third party would use the technology to enable automatic user identification using video capture of an identity document and of the customer’s face using a cloud security platform. The controller would not receive or store biometric templates, facial images or other biometric data in raw form, but only the result of the electronic identification process.

The commission said it was unable to assess in an unbinding opinion whether, in the processing of biometric data as described above, the processing activities would be under the exclusive control or authority of the customer. That said, the opinion notes that the processing of biometric data in the private sector may only be carried out in accordance with the requirements of article 83 of Slovenia’s Personal Data Protection Act, which specifies that such processing is permitted only when necessary for the performance of business activities, for the safety of the people, the security of property, the protection of classified information, or the protection if business secrets.

Additionally, under article 52 of the act, processing of biometric data for the purpose of protecting the accuracy of the data of its clients is allowed if the processing is provided for in another law, defined in a contract, or conducted with the explicit consent of the individual. If the processing is based on a contract with the consumer, the controller is required to offer a method of identification that does not require the processing of biometric data.

The opinion also states that under article 83, there is a separate legal basis where the processing is under an individual’s exclusive control, which assumes that the information is not stored in centralized databases maintained by a controller or processor, but instead media and devices, like mobile phones and USB sticks, that are under the individual’s control. In such cases, the verification process is carried out on the individuals’ devices or equipment, and the controller is not provided with any biometric data. The commission added, however, that it could not, in a nonbinding opinion, determine whether the processing posited by the entity requesting the opinion met this legal basis.

Finally, the opinion emphasized that any processing of biometric data in the private sector must be confirmed in accordance with the requirements of article 52, which provides for the certification of such processing.

News: InternationalLegislation DataPrivacy