Complex analysis of an access control and management system and bringing it in line with current legislation

The lawyers of the practice advised a major international company in connection with the enactment of Federal Law No. 572-FZ dated 29 December 2022 “On identifying and/or authenticating individuals using biometric personal data, on amending certain legislative instruments of the Russian Federation and on repealing certain provisions of legislative instruments of the Russian Federation” (“572-FZ”). The company has an access control and management system (ACMS) installed: employees’ photographs are placed on the ID card and in the electronic ACMS. It is also planned to implement a facial and fingerprint recognition system for unblocking laptops (Windows Hello).  Hence, the client needed advice on whether the requirements of 572-FZ had to be complied with as well as on the necessary steps aimed at complying with the above requirements.

Our lawyers carried out a comprehensive analysis of the ACMS used in the company (including from the technical viewpoint). The opinion described the risks connected with the use of the current ACMS and suggests possible ways to mitigate them. In addition, the opinion pointed out the need to bring the ACMS in line with the requirements of 572-FZ.

Regarding the use of Windows Hello, our experts researched the positions of the Federal Service for Supervision of Communications, Information Technology and Mass Media in relation to similar issues, and developed an offer agreement based on which the system could be used. The client received a sequential, structured and grounded opinion elucidating how far 572-FZ is applicable to the use of Windows Hello.

Normally, there have not been any single decisions about the need to fulfil the requirements of 572-FZ in relation to processes which take place within companies. In addition, the analysis of the issue of using Windows Hello is complicated by particular features of the intra-company conditions for using software in the company. Within the framework of the project, we performed a comprehensive analysis of aspects relating to the processing of biometric data, including in the light of further prospects for developing legal regulation.