How Biometric Technologies Ensure Personal Privacy

The Need for Privacy Protection with Biometrics

Biometric technologies provide proof of identity by scanning and measuring an individual's unique physiological or behavioural characteristics -- typically by comparing real-time input from a subject with previously enrolled biometric information stored in the system database. In this way, biometrics offers quick, accurate, and convenient identification or identity verification of subjects for numerous purposes.

As we have discovered in previous instalments of this series, biometric technology finds applications in a wide range of industries, including finance, travel, healthcare, education, and office work, among others. Besides speed and convenience, biometric systems offer users and operators enhanced physical security and cybersecurity, cost savings, improved auditing, and the ability to scale.

However, the fact that biometrics rely on the processing and handling of information relating to unique personal identifiers can be a cause of some concern. Because of the high value that can be extracted from such information, biometric databases are a rich target for hackers, identity thieves, and other malicious actors. At the operational level, some biometric systems enable remote or surreptitious data gathering without the subject’s consent, raising issues of illicit surveillance and abuses of personal privacy.

Due to such concerns, developers of biometric systems are under increasing pressure to ensure that their technologies and techniques can provide strong protection for personal privacy. In this concluding article of our series, we’ll look at the various ways biometrics can achieve this.

Operational Strategies for Biometric Privacy Protection

Before implementing a biometric technology solution, organisations should first develop a strategic template for how biometric recognition will be used in identification and authentication systems, and how biometrics will be used within the organisation without compromising individual privacy rights or putting personal information at risk of being accessed by unauthorised parties.

Organisations should therefore take steps to ensure that any biometric data within the system remains secure at all times. This should ideally involve a combination of digital and physical infrastructure security measures for data protection.

Biometric systems typically transform input data from a subject into a codified form of some kind, rather than recording complete images or scans. This inherently provides a level of privacy protection. However, for greater protection, organisations should also encrypt biometric data and store it in a secure location. Ideally, encryption devices and keys should be physically protected by storing them in a location remote from the main biometric computer system.

There should also be a strict policy on data retention times, to minimise the risk of potential exposure for all personal information. The longer such data remains at a particular location, the greater the chances of it being stolen or misused. During any data retention period, the organisation should conduct regular inventories of sensitive information, to ensure that records have not been switched out or tampered with in any way.

At the user interaction level, biometric subjects should be informed at the point of enrolment how much their personal information is being collected, the type of information saved, as well as when and how it is being used. A transparent approach to data collection and usage will help ensure that individuals are not being tracked or monitored without their knowledge.

Biometric Tools and Frameworks for Privacy Protection

In the US, the Department of Commerce’s National Institute of Standards and Technology (NIST) has developed a set of frameworks and associated tools for privacy protection in biometrics deployment.

Modelled after its highly successful Cybersecurity Framework, the NIST Privacy Framework is a voluntary tool developed in collaboration with stakeholders. It intends to “support organisational decision-making in product and service design or deployment, to optimise the beneficial uses of data while minimising adverse consequences for individual privacy and society as a whole.” The framework is supported by the NIST Privacy Risk Assessment Methodology. This tool provides organisations with the capability to identify and prioritise privacy risks in the systems, products, and services that they are designing or deploying.

One of the Subcategories of the Privacy Framework makes recommendations for the processing of data in ways that can limit its vulnerability to being externally observed or linked -- for example, by having data actions take place on local devices or using privacy-enhancing cryptography. So, storing biometric data on a local device with the user can lower the privacy risk in comparison to matching against a centrally stored database.

A second Subcategory articulates the use of “differential privacy” in biometric systems, where the technology can generate datasets for statistical analysis without revealing whether any particular individual’s information is contained in the dataset. In the medical field, for example, this could enable the analysis of biometric images in health records without being able to link them to specific individuals.

A third Subcategory of the Privacy Framework recommends techniques such as federated learning for the training of biometric models across distributed datasets. This approach would allow model training on biometric databases without the risk of combining datasets and increasing the potential to learn more about an individual’s behaviour or activities.

Legal Statutes and Frameworks to Ensure Personal Privacy with Biometrics

Around 130 countries now have data protection laws, with almost all covering biometric data protection guidelines. For instance, in the EU, the General Data Protection Regulation (GDPR) includes biometric data as a “special category of personal data”, whose processing is prohibited. However, the GDPR framework includes an exemption to this in an employment setting, if the “subject has explicitly consented to the processing.” So particularly in cross-border or international applications, users of biometric systems must also take steps to comply with the data and personal privacy regulations that apply in the regions within which they operate.

Not all such statutes are entirely prohibitive. In Canada for example, the government has provided a number of guidelines that organisations can use to strengthen privacy protections for initiatives that involve the use of biometrics.

First among these is to take a proactive approach to privacy -- that is, adopting a “Privacy by Design” approach that bakes privacy solutions into the very fabric of the initiative from the start. Privacy concerns should also extend throughout the life of the initiative, “from its design through its implementation, evaluation, and even dismantling.”

Organisations should also conduct a Privacy Impact Assessment, to determine the impact that a new or substantially modified initiative might have on people’s privacy -- especially when it involves the collection of personal information.

For stakeholders in the travel sector, the Canadian government recommendations extend to the deployment of an e-passport containing biometric information on an electronic chip. Here, system designers should restrict the data stored on the chip to only that essential for passport purposes and secure this information, and introduce protocols to ensure safe disposal at the end of the chip’s life.

This concludes our series looking at the various principles, components, and benefits of biometric technology. Keep watching this space to find out more about biometrics, the travel sector, and our range of biometric solutions.