On March 26, 2024, His Majesty Sultan Haitham bin Tariq issued Royal Decree No. 2024/21 Promulgating the Biometric Law which outlines the legal requirements for the collection and processing of biometric data.

Scope

The Biometric Law applies to biometric data including fingerprints, palmprints, facial scans, and eye scans. Additionally, the Biometric Law applies to genetic data and Deoxyribonucleic Acid (DNA).

Obligations

The Biometric Law provides that the privacy and personal data of persons must be protected during the collection of biometric and genetic data. Further, the Biometric Law:

• prohibits the processing of genetic data for paternity tests except in certain circumstances;
• requires reference biological samples to be kept for a minimum of 10 years;
• prohibits private health institutions from conducting genetic tests without first obtaining a license; and
• prohibits the collection of a reference biological sample from a child except in the presence of their guardian or legal representative.

Biometric database

Notably, the Biometric Law establishes a biometric database that shall contain reference biological data collected from crime scenes, criminal defendants, and relatives of missing persons, among others. Under the Biometric Law, the data recorded in the biometric database shall be confidential and may not be accessed except with the permission of the Inspector General or their authorized representative.

Penalties

With regards to penalties under the Biometric Law, organizations and natural persons may be subject to fines ranging from a minimum of OMR 100 (approx. $260) to a maximum of OMR 5,000 (approx. $12,990).

The Biometric Law came into force on April 1, 2024, following its publication in the Official Gazette.

You can read the Biometric Law, only available in Arabic, here.