Article 29 WP - Opinion - biometrics

The Article 29 Data Protection Working Party recently adopted an Opinion on developments in biometric technologies (Opinion 3/2012).

http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2012/wp193_en.pdf

Purpose of the Opinion

"The purpose of this opinion is to provide a revised and updated framework of unified general guidelines and recommendations on the implementation of privacy and data protection principles in biometric applications. This opinion addresses European and national legislative authorities, the biometric systems industry and users of such technologies."

Definition of "biometric data" (from Opinion 7/2007)

“biological properties, behavioural aspects, physiological characteristics,living traits or repeatable actions where those features and/or actions are both unique to that individual and measurable, even if the patterns used in practice to technically measure them involve a certain degree of probability.”

With regard to "technical measures", the Opinion covers:

- Use of biometric templates

"Biometric data should be stored as biometric templates whenever that is possible.

Template should be extracted in a way that is specific to that biometric system and not used by other controllers of similar systems in order to make sure that a person can only be identified in those biometric systems that have a legal basis for this operation."

- Storage on a personal device vs. centralised storage

"Whenever it is permitted to process biometric data, it is preferred to avoid the centralised storage of personal biometric information. ...

- Renewability and revocability

- Encrypted form

"... biometric information must always be stored in encrypted form...

... the use of specific technologies or data formats that make interconnections of biometric databases and unchecked disclosures of data impossible should be preferred."

- Anti-spoofing

- Biometric encryption and decryption

"... The system must therefore be able to compute the same key from slightly different biometric data, without increasing the False Acceptance Rate. ..."

- Automated data erasure mechanisms

- Large biometric databases and "weak link" databases

"... Example: technical measures for authentication systems ... systems using biometric authentication must implement special safeguards to protect the link between biometric and other identity data..."

Received on Friday, 18 May 2012 07:14:52 UTC