Russia’s biometric school security plan promises safety but risks students’ personal data

The Russian authorities are considering introducing a state-run “biometric access system” for school premises. In late November, Deputy Prime Minister Dmitry Grigorenko announced during an address to the Federation Council that a relevant bill was being prepared.

The idea is to help schools plug loopholes in existing electronic entry systems, for example, when intruders use lost or stolen access cards. Facial-recognition biometrics are meant to prevent such breaches. The system would compare an image of a person’s face with stored samples and determine whether a match exists based on a predefined accuracy threshold. It would also check for “liveness” (blinking, pupil movement, and other involuntary reactions) to ensure that it isn’t being tested with a photograph.

You’re currently reading Meduza, the world’s largest independent Russian news outlet. Every day, we bring you essential coverage from Russia and beyond. Explore our reporting here and follow us wherever you get your news.

Assuming schools retain their current autonomy in this area, educational institutions are free to decide for themselves how to organize access controls. Russia’s most recent national standards on school security entered into force on January 1, 2025. Those provisions on entry and internal security do not explicitly mention biometrics (or even electronic access cards, for that matter). Schools can open their doors relying only on class lists if they wish.

Additionally, Russia’s current practices for handling biometric data allow people to opt out, though this hasn’t always worked smoothly. It won’t be clear how school biometrics are meant to work until a draft of Grigorenko’s legislation is published. Presumably, schools will need to offer alternative, non-biometric access to students who don’t want their faces logged. 

Existing biometric security systems in Russia have run into problems. The news outlet Octagon reported that since the fall of 2024, biometric turnstiles have begun operating in some colleges, music schools, and art schools. At the Edward Grieg Children’s Music School in Moscow, for example, students whose parents decided not to share their children’s biometric data are forced to crawl under the barrier.

Currently, registration of facial images or voice samples in Russia’s Unified Biometric System (the planned repository for nationwide school biometric access) is entirely voluntary. In the system’s initial phase, participants had to appear in person at a government service center or a branch of an accredited bank. Today, you can register through the “Gosuslugi Biometrics” mobile app, provided your device is NFC-enabled and your foreign-travel passport is Russia’s new biometric version.

Grigorenko’s office told the newspaper Kommersant that the Gosuslugi Biometrics app could also be used to register schoolchildren’s biometrics, but only with the consent of a parent or legal guardian.

A pilot biometric access program is already underway in 20 schools in Tatarstan. The regional Education Ministry told Kommersant that the biggest challenge has been obtaining parental consent to use children’s data. The newspaper didn’t specify why parents are reluctant to participate in the system, but they may fear leaks of their children’s biometric data and other personal information. (Russia has a thriving black market for such government records.)

We don’t know how the Russian authorities might use this biometric data in the future. It’s possible that this information could be used outside schools by police, including for political repression in an increasingly authoritarian regime.

There are recent signs that federal officials already share biometric data with the police. For example, on October 21, during a Federation Council discussion about Russia’s Unified Biometric System, a Digital Development Ministry official said the agency provides citizens’ biometric data to law enforcement bodies upon special request. In the same discussion, a Federal Security Service representative proposed incentivizing the public to register more actively with the Unified Biometric System. Additionally, an official from the biometric system itself suggested to senators that automatic data sharing with police would be more effective if enrollment were mandatory.

Russian law allows people to withdraw their consent for the processing of their biometric personal data and demand that it be deleted, but you’re forced to take the state at its word. There’s no system for verifying that your biometric samples were actually removed from government databases — or that Russia’s security services didn’t make backup copies of the information.