CIK BiH: Fingerprint Data Is Deleted, Not Stored
Bosnia's Central Election Commission adopted a rulebook on August 13 on biometric voter verification: the device creates an encrypted template, not a fingerprint, and deletes it once voting ends.
The Central Election Commission of Bosnia and Herzegovina (CIK) adopted a rulebook on Thursday spelling out what happens to a voter’s fingerprint data, from the moment a device scans it to the moment it disappears from the system. The decision also affects voters in Republika Srpska, who will use the same election to choose the entity’s president and its National Assembly, which is why election day next door will be watched more closely in Belgrade than any other vote in the region.
The document, formally titled the Rulebook on the Secure Electronic Transfer and Processing of Data and the Use of the Biometric Voter Identity Verification System in the Election Process of Bosnia and Herzegovina, was adopted at the commission’s 49th session, held on August 13. The proposal was drafted by the commission’s Legal Affairs Sector, and every member present voted in favor.
The rulebook sets out who may access voter data and under what conditions, covering the Central Election Commission, the Agency for Identification Documents, Registers and Data Exchange of Bosnia and Herzegovina (IDDEEA), election commissions and polling boards. Miso Krstovic, head of the Legal Affairs Sector, presented the proposal at the session.
“The methods and conditions for the processing and secure electronic transfer of data between CIK, the Agency for Identification Documents, Registers and Data Exchange of Bosnia and Herzegovina (IDDEEA), election commissions and polling boards have been regulated.”
Comments and suggestions from the Personal Data Protection Agency were incorporated into the final text of the rulebook.
What Happens to a Fingerprint After Voting?
None of what the public normally pictures as a fingerprint is actually kept on file. When the device scans a finger, it does not produce an image of the ridge pattern, only a temporary, encrypted biometric template that is automatically deleted once the voting procedure ends. Commission member Irena Hadziabdic explained the process at the session.
“When the system reads a fingerprint, it does not generate a physical fingerprint, only a temporary encrypted biometric template, and even if someone from outside got hold of it, it could not be converted back into a fingerprint.”
Hadziabdic also addressed how long the data even exists.
“The entire procedure is used exclusively for conducting the election, and only for a very short period, because once the procedure is finished the temporary biometric template, as we call it in this act, is automatically deleted and cannot be used for any other purpose.”
Commission member Zeljko Bakalar spoke about the data’s journey, from the IDDEEA database to the device at the polling station and back, since that leg, rather than the reader itself, is where most of the risk lies.
“It is important to protect the data both while it is on the device and during the actual procedure of transferring it from IDDEEA to the device and in transit.”
Bakalar described the adoption of the rulebook as fulfilling an obligation the Central Election Commission holds as a data controller.
“By adopting this act, we believe we have done what our obligation as a controller requires.”
First Election Day With Electronic Identification
The rulebook comes less than two months before voters go to the polls. Bosnia and Herzegovina’s general election is scheduled for Sunday, October 4, 2026, the first time electronic voter identification and ballot scanners will be used in the country.
Voters will elect:
- the Presidency of Bosnia and Herzegovina
- the House of Representatives of the Parliamentary Assembly of Bosnia and Herzegovina
- the House of Representatives of the Parliament of the Federation of Bosnia and Herzegovina
- the National Assembly of Republika Srpska
- the president and vice presidents of Republika Srpska
- cantonal assemblies
For an electorate voting for both entity level and state level bodies, the rulebook adopted on August 13 is the first document to lay out, in one place, exactly what the device does with a fingerprint and how long that data survives. The real test comes on October 4 itself, when the equipment will have to perform at several thousand polling stations at once.
