Biometric data is personal information: it is derived from an individual, is used to verify or determine a person's identity, and depending on the technology, may be a highly distinctive representation of a physiological or behavioral characteristic. The proposition that biometric data is not personal information is based on a semantic distinction between data and its usage, and does not take into account the purposes for which biometric data is used. 

Although biometric data is personal information, there are various situations in which its collection, storage, and usage by individuals, employers or government agencies is beneficial. Biometric data is a type of personal information which, if used properly, can protect other, more sensitive personal information. This capability of biometrics to protect sensitive personal information, such as records pertaining to health, employment, or finances, is the primary basis of biometrics being positioned as a privacy-enhancing technology. 

Because biometric data is sensitive, and there are situations in which biometric systems could be misused, protections tantamount to the deployment-specific risks are necessary at all possible stages of the data's lifecycle.

Are biometrics unique identifiers?

A unique identifier is a fixed number or value associated with a specific person. The most common example of a unique identifier would be the Social Security number, which is issued at a young age and used for the purposes of employment and taxation throughout one's life. Unique identifiers are problematic from a privacy perspective, as they make possible the linking of information in separate databases. Social security numbers have come to be used as semi-unique identifiers (some numbers are mistakenly issued more than once, and users can assume false social security numbers). 

Biometric templates, then, are highly reliable identifiers, but they are not unique identifiers. The more relevant question is whether biometrics can be used as semi-unique identifiers. At this point, such usage would be exceptionally difficult, but cannot be ruled out. In order for biometric data to be tracked across multiple databases (i.e., to function as a unique identifier), a single biometric vendor would have to supply all of the core technology. Recall that different finger-scan vendors’ templates are not interchangeable or comparable. Assuming that only one biometric company provided the core matching technology for all systems, the companies managing the databases – employers, retailers, trusted third party providers - would need to access vendor source code in order to match templates. Even with the complicity of the biometric vendor and the companies responsible for storing and managing personal data and the biometric vendor, the ability to compare against large databases is limited by the enrollment quality and by the actual finger enrolled. A user who uses the left index at home and the right index at work renders even this theoretical risk moot.  

All of this assumes that the biometric templates are stored centrally. There are many situations in which template database is desirable or necessary, others where it is best to decentralize stored biometric data. Many deployments will give the users themselves control over data in the form of tokens or smart cards.

Do biometric comparisons result in exact, 100% matches?  

One of the most interesting facts about most biometric technologies is that unique biometric templates are generated every time a user interacts with a biometric system.  As an example, two immediately successive placements of a finger on a biometric device generate entirely different templates. These templates, when processed by a vendor’s algorithm, are recognizable as being from the same person, but are not identical. In theory, a user could place the same finger on a biometric device for years and never generate an identical template.

Therefore, for most technologies, there is simply no such thing as a 100% match. This is not to imply that the systems are not secure – biometric systems may be able to verify identify with error rates of less than 1/100,000 or 1/1,000,000. However, claims of 100% accuracy are misleading and are not reflective of the technology’s basic operation.

What are commonly expressed fears regarding biometrics and privacy?

The basic classifications of privacy are personal and informational. It is rare that objections to biometric are expressed systematically: it is much more likely that objections to biometrics are called “slippery slope” or “Big Brother” without further elaboration.

Personal Privacy. For some people, the use of biometrics is seen as inherently offensive. Being required to verify one’s identity through a finger-scan or voice-scan can be seen as intrusive, impersonal, or mistrustful. These objections to biometrics are based on personal privacy.

Informational Privacy. A more common objection to biometrics is based on informational privacy; how biometric data might be misused, tracked, linked, and otherwise abused. Potential privacy-invasive misuses of biometrics are as follows:

Unnecessary or unauthorized collection – gathering biometric information without the user’s permission or knowledge, or gathering biometric data without explicitly defined purposes

Unauthorized use – using biometric information for purposes other than those for which it was originally acquired

Unauthorized disclosure – sharing or transmitting biometric information without the user’s explicit permission

Unique identifier – using biometric information to track a user across various databases, to link different identities, and to amalgamate personal data for the purposes of surveillance or social control

Improper storage – storing biometric information in logical proximity to personal data such as name, address, social security number

Improper transmission – transmitting biometric information in logical proximity to personal data such as name, address, social security number

Forensic usage – using biometric information to facilitate investigative searches, which may be categorized as unreasonable search and seizure

Function creep – gradually using biometric data for a variety of purposes beyond its original intention and scope

Are biometric templates secrets? If my template is compromised, does that mean that I can never use that biometric again?

Not in a well-designed system. If a criminal steals or guesses your password, it is very easy to have it changed. There is a fear, however, that if a criminal gets hold of a biometric template, the damage is irreparable - there is no way to change that part of your body. Although templates are often encrypted when in transit and storage in order to protect against such an occurrence, what happens if a template is compromised?

The answer depends on how well a biometric system is designed. If a system allows a template to be inserted into the verification process without ensuring that this template came from an actual placement, a compromised template can pose a problem. However, a well-designed system will ensure that the information it is analyzing is not a recording but is in fact a new sample.

One way to assure that a new template is being submitted is to seed the request for a sample. This involves the biometric system sending an encrypted random number (known as a seed) to the biometric sensor. This number can be encrypted such that only the sensor itself can decrypt the message. When returning the biometric template, the sensor also sends the seed number back (encrypted). This ensures that the template being sent was created immediately after the request for the template (as opposed to an old template that has been recorded and played back).

The following chart illustrates a request for a biometric sample with a seed value of 3434.

Note that biometric templates cannot be used to regenerate original biometric data.

What is the difference between forensic fingerprinting technology and biometric finger-scan technology?

Many people think of forensic fingerprinting as an ink and paper process. While this may still be done in some locations, most jurisdictions utilize optical scanners known as livescan systems. There are some fundamental differences between these forensic fingerprinting systems (used in AFIS systems) and the biometric finger-scan systems used to logon to a PC:

Response time - AFIS systems may take hours to match a candidate, while finger-scan systems respond with seconds or fractions of seconds.

Cost - an AFIS capture device can range from several hundred to tens of thousands of dollars, depending on whether it is designed to capture one or multiple fingerprints.  A PC peripheral finger-scan device generally costs less than $200

Accuracy - an AFIS system might return the top 5 candidates in a biometric comparison with the intent of locating or questioning the top suspects. Finger-scan systems are designed to return a single yes/no answer based on a single comparison.

Scale – AFIS systems are designed to be scalable to thousands and millions of users, conducting constant 1:N searches. Finger-scan systems are almost invariably 1:1, and do not require significant processing power.

Capture – AFIS systems are designed to use the entire fingerprint, rolled from nail to nail, and often capture all ten fingerprints. Finger-scan systems use only the center of the fingerprint, capturing only a small fraction of the overall fingerprint data.

Storage – AFIS systems generally store fingerprint images for expert comparison once a possible match has been located. Finger-scan systems, by and large, do not store images, as they are not used for comparison.

Infrastructure – AFIS systems normally require a backend infrastructure for storage, matching, and duplicate resolution. These systems can cost hundreds of thousands of dollars. Finger-scan systems rely on a PC or a peripheral device for processing and storage.

Can you recreate an image of the sample from a template?