ICO launches public consultation on guidelines for biometric data use
31st August 2023
ICO launches public consultation on guidelines for biometric data use
In the realm of data privacy and protection, biometric data has emerged as the next new technological challenge for the Information Commissioner’s Office (ICO) to tackle.
The ICO, the UK’s guardian of information and data rights, has recently released the initial draft of its guidance on biometric data and providers parameters for both controllers and processors of the resulting information.
What is ‘biometric data’?
Biometric data, encompassing biological and behavioural traits, takes centre stage in modern identification and authentication processes. Think iris scanning and fingerprint recognition – these are powered by biometric technologies. These technologies offer enhanced security, convenience, and accessibility, but their utilisation comes with a responsibility to safeguard individuals’ privacy.
ICO’s Biometric Data Guidance: An Overview
The ICO’s draft guidance targets not only organisations already utilising biometric recognition systems but also those contemplating their adoption, along with vendors providing these systems. It outlines the application of data protection laws to biometric data usage, shedding light on crucial aspects such as data protection by design and by default, Data Protection Impact Assessment (DPIA) necessities, and strategies to mitigate discrimination risks.
While the ICO’s guidance offers valuable insights, it’s essential to note its deliberate focus. The guidance isn’t an exhaustive compliance handbook, but rather a roadmap leading to deeper understanding. It points to related resources and principles covered in existing guidance documents.
Consultation and Future Phases
The ICO is committed to inclusivity and transparency. They’ve opened the floor for consultation, inviting stakeholders to provide feedback on the draft guidance until October 20, 2023. Moreover, the ICO has announced a follow-up phase, expected early next year, which will delve into biometric classification and data protection, accompanied by a call for evidence.
Challenges and Considerations
Biometric technologies are not without their challenges. The ICO’s investigation has unearthed concerns regarding data privacy and potential bias. It’s highlighted issues like systemic bias tied to facial and gait recognition algorithms, the inadvertent revelation of personal data through pupillometry (eye) and brain analysis, and the permanence of biometric data compared to traditional passwords.
Citizen’s Biometrics Council and ICO’s Progress
The Ada Lovelace Institute Citizen’s Biometrics Council has recognised the ICO’s positive steps in formulating biometric data guidance. However, they emphasise the need for effective enforcement mechanisms and even propose the potential requirement of new biometric-specific legislation. The Council suggests that there is a significant gap in public awareness about biometric data use, emphasising the need for educational efforts.
The Council has made recommendations for the ICO. They advise a shift from mere guidance to the establishment of codes of conduct or legislation. This perspective, however, contrasts with the proposal within the Data Protection and Digital Information Bill currently passing through Parliament, and expected to be law in 2024, to eliminate the role of the Surveillance Camera and Biometrics Commissioner. A merging with the Investigatory Powers Commissioner is being proposed. The Council also stresses the importance of continuous policy updates, public engagement, accessibility and inclusion, and ethical concerns like transparency.
The ICO’s comprehensive draft guidance on biometric data usage in business operations provides a solid foundation for organisations venturing into the realm of biometric technologies. While challenges exist, the guidance helps to promote responsible and secure use. Stakeholders now have the opportunity to contribute their insights during the consultation phase which is open until 20th October 2023, ensuring that the final guidance addresses a wide spectrum of perspectives, and ultimately strengthens data protection and privacy measures in the ever-evolving landscape of biometric data utilisation.
If you would like any help or assistance regarding the ICO launches public consultation on guidelines for biometric data use, biometric data in your organisation or any additional privacy concerns then please take advantage of your thirty-minute consultation with one of our data protection specialists. Book yours here.
