The use of fingerprints and retina scans has been a feature in spy and crime movies for a long time, but today is a very real part of life. Biometrics is the phenomenon of recognizing individuals by their physical or behavioral traits using biometric technology. Examples of biometric data are fingerprints, palm prints, retina scans, DNA matching, typing rhythm, gait, signatures, and facial recognition. Biometrics measures distinct and generally unalterable characteristics of individuals. With the growth of technology in the past several decades, biometric technology is now faster, more accurate, and more affordable than it has ever been.
The current uses for biometric data include: control of physical access to spaces, accounts, vehicles, and medical records; surveillance; identification; fraud prevention; distribution of benefits; time and attendance tracking for places of employment and/or schools; and air travel and border control. Because the use of biometric data has increased in recent years, the conversation about its implication on privacy has become heated.
Privacy Concerns Surrounding Facial Recognition Technology
There are several privacy concerns associated with the growing use and implementation of biometrics. Professor Dryer outlines some of the major concerns in his youtube lecture. They include: length of storage, access rights, usage of information, focus of usage, data errors, use of information to manipulate consumer behavior, potential discrimination, and the growth of “Big Brother”. One of the main concerns is around the use of facial recognition technology. According to the GAO Facial Recognition Technology Report, facial recognition differs from the other biometric technologies because it does not require the individual to directly interact with the technology. This paired with the technology’s abilities has privacy advocates fired up.
Facial recognition technology uses facial feature measurements to create a faceprint in order to verify the identity of a known person or to identify an unknown person. For more information about how the technology works watch this video that was provided through our readings. The use of facial recognition technology has received a lot of attention with the dawn of social networking apps like NameTag, promotional apps like Facedeals, as well as the patented Microsoft billboard that scans your face and then custom displays ads targeted for the identified individual. Facebook has received attention from privacy advocates because of their facial recognition algorithm that allows it to identify users in pictures and suggest people to tag. Facebook has collected one of the biggest biometric databases simply by having individuals tag themselves and friends in pictures. Not only has this allowed for a large data base, but the technology Facebook is using is highly accurate. According to a Washington Post article, Google’s facial recognition algorithm FaceNet has 99.63% accuracy, Facebook’s algorithm DeepFace has 97.25% accuracy, and the FBI has 85% accuracy. Because of concerns about Facebook’s use of facial recognition technology without consent and the privacy implications on individuals, they have become the defendant in a large lawsuit Licata v. Facebook.
Potential Benefits of Biometrics
While there are legitimate privacy concerns associated with biometrics, biometric data can also be used beneficially and can even protect our security in certain ways. Biometrics offers an efficient solution for business owners when it comes to security operations. Biometrics is by far the fastest way to accurately identify people. Biometric characteristics cannot be duplicated, guessed, lost, or forgotten, which allows for confident identification of individuals. In addition, being able to track activity and transactions creates complete employee accountability. The use of biometrics can also make it significantly harder to commit fraud, making banking more profitable and secure.
The use of biometric identification has also become a new way to fight the war on terror and control borders. The US, UK, and Canada have implemented biometric technology at borders. The Department of Homeland Security has implemented biometric border control starting with the US VISIT program and now the OBIM to accurately separate between leisure and business visitors and terrorists and illegal aliens. The US has also started using biometric passports called e-Passports as a way to more efficiently and accurately move travelers through security at borders. This is definitely a relevant interest to today with the growing threats of ISIS and the increase in terrorist action.
Current Privacy Laws and Suggestions for Protection from Biometrics
Currently there is very little in the way of privacy protection laws regarding Biometrics. Only two states, Illinois and Texas, have any formal legislation expressly giving privacy rights to individuals regarding biometrics. Illinois and Texas have statutes that regulate the use, disclosure, and destruction of biometric data by private organizations or individuals. The lawsuit against Facebook, Licata v. Facebook, was filed first in Illinois under the Illinois Biometric Information Privacy Act. Arizona, Illinois, and Louisiana do not allow schools to collect biometric data without parental consent. Maine, Missouri, and New Hampshire prohibit the use of biometric data with driver’s licenses. Other than those restrictions, there are no other legal restrictions to date on biometric data use and collection in the United States. Even though only two out of fifty states have statutes regarding biometrics, these two statutes end up giving one in eight Americans the legal right to biometric privacy.
While there is no federal law and many states do not have statutes regarding biometric privacy, several private and public organizations have put together lists of suggestions for biometric privacy. The Federal Trade Commision has put together a list that is summarized well by one of our readings. The overall consensus seems to be that the use of biometrics is okay as long as: databases are secure, there is a process for deleting data, data is not collected in places where people have a reasonable expectation of privacy, a sign is posted letting people know if there is facial recognition technology doing facial scans, there is an option to opt out, consent is gained before using data, and is not used to identify anonymous persons.
My Personal Views