• Gemalto is now part of the Thales Group, find out more.

Biometric data and the General Data Protection Regulation

​​​​​​​​​​​​​​​​​​​​​​​​​​​Biometric Data

Despite the very particular character of such information, there are virtually no legal provisions in the world that are specific to biometric data protection. Legal texts instead rely on provisions relating to personal data protection and privacy in the broad sense. But such legislation sometimes proves to be poorly adapted to biometric data. Assuming – that is – there is any such legislation at all...

For a general overview of biometrics, we suggest our 2017 dossier on biometric authentication. ​​

To understand how biometrics is gaining momentum in 2018, read our April 2018 web dossier on recent trens in biometrics.

Biometric data and privacy: what the law says

However, the General Data Protection Regulation (GDPR) for European Member States does address biometric data and represents a major step forward for data protection and privacy. 28 countries are impacted including the UK. We will see how the UK, France and the Netherlands are getting ready for this new law.

In the United States, there is no single, comprehensive federal law regulating the collection and use of biometric data. However Washington, following Illinois and Texas, just passed a biometric privacy law in June 2017. Clearly, US regulators are also increasingly focusing on the use of biometric data.

In August 2017, India's supreme court ruled privacy a "fundamental right"in a landmark case illustrating that biometric data protection is now on top of regulators' agenda in the largest democracy of the world.

Let's dig in.

In this web dossier we will focus on 5 topics:

  1. Biometric data within the GDPR
  2. Main objectives and provisions of the GDPR (including a video)
  3. Preparation for the GDPR in three countries: France, the Netherlands and the UK
  4. US legal landscape for biometric data protection
  5. India and the emerging consensus on ​​biometric data protection.

​GDPR timeline: 25 May 2018

​ The EU GDPR establishes a harmonized framework within the European Union, the right to be forgotten, clear and affirmative consent and, amongst other things, serious penalties for failure to comply with these rules.

  • The Regulation 2012/0011 was ​adopted officially on 27 April 2016 
  • It came into force on 24 May 2016 
  • Member States have to transpose it into their national law by 6 May 2018 
  • ​​The provisions of the Regulation is applying as of 25 May 2018.

​​National governments do not have to pass any enabling legislation. The new legislation will replace the existing national laws.Biometric information

What is biometric data​​ for the EU regulation?​

The EU data priva​cy law​ defines biometric data as "special categories of personal data" and prohibits its "processing", thereby protecting people from having their information shared with third parties without their consent. 

Biometric data are “personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allows or confirms the unique identification of that natural person, such as facial images or dactyloscopic data". 

Their processing for the purpose of "​uniquely identifying a natural person” is prohibited. 

However, it does contain some exceptions:

  • ​​If consent has b​een given explicitly
  • If biometric information is necessary for carrying out obligations of the controller or the data subject in the field of employment, social security and social protection law
  • If it's necessary to protect the vital interests of the individual and he/she is incapable of giving consent
  • If it's vital for any legal claims
  • If it'​​s necessary for reasons of public interest in the area of public health.

​Moreover, the Regulation permits Member States to introduce other limitations regarding the processing of biometric information.

​Main objectives and provisions of the GDPR

The main objective of the text is to give back to European citizens control over their personal data, while simplifying the regulatory framework for companies. More precisely, this means that after 25 May 2018, there is only one set of rules directly applicable in all the European Member States regarding the protection of personal data.

But wait, there's more...

EU residents will gain more control of their personal and biometric data. 

The right to be forgotten

The Regulation states that the consent must be explicit before the collection of the data. It also explains that "the data subject shall have the right to withdraw his or her consent at any time" aslo known as "the right to be forgotten".​

Data breach must be notified within 72 hours

Not only does it establish a clear set of consumer rights, GDPR also includes measures aimed at boosting enterprise security. For example, if a company discovers a data breach, then processors must inform the authorities within 72 hours of discovery. Companies managing biometric information could be hit with massive penalties if they do not make efforts to secure that data. These could reach 20 million euros, or 4% of annual worldwide turnover.

A global law 

And here is why this law has a true international impact....

Non-EU established organizations will be subject to the GDPR where they process personal data about EU data subjects. This makes the GDP a global law. 

Privacy by design and by default

Data usage should be limited to what is necessary. The Regulation states that personal data shall be collected for "specified, explicit and legitimate pruposes". It shall not be further processed "in a manner that is incompatible with those purposes". The personal data collected should be adequate, relevant and limited to what is necessary (the data minimization principle).​

The Regulation states that, by default, only personal da​ta which is necessary for a specific purpose should be processed. In order to meet this objective, the controller must implement the technical and organizational measures needed. This means​​ that data protection will have to be designed into the development of business processes for products and services.​

With a clear focus on biometrics

For biometric security to work properly, citizen rights must be properly protected and the data collected by private and public organizations managed carefully and sensibly. The new GDPR focus specially on biometrics, clearly recognizing the technology's immense potential

​​What does the GDPR mean for companies?

One of the goals of the GDPR is to simplify the requirements for companies working in several European Member States.

More precisely, the GDPR establishes a "one-stop-shop" for companies that are active in several European countries. They will only have to deal with the Supervisory Authority of the country where their "main establishment" is located (e.g. the place where the main processing activities take place). This Supervisory Authority will then play the role of "lead authority" and supervise all the processing activities of the company in the European Union.

Moreover, one of the most important new obligations is the appointment of Data Protection Officers (DPOs) in some specific companies (over 250 employees). The role of the DPO will only be to verify the compliance of the company's activities with the GDPR.

More details regarding the DPOs were adopted by the Article 29 Data Protection Working Party (WP29) on December 13 2016 in its guidelines on the subject. 

Now, let's see how the UK, France and the Netherlands are preparing for the GDPR.

UK data protection bill, incorporating biometric data, announced in September

​The GDPR is applying in the UK as of 25 May 2018.

In June 2017, the British government presented its legislative program for the next two years, bringing GDPR into UK law and the country into line with the EU. The UK's decision to leave the EU is not affecting the implementation of the GDPR.

Of course, some post-Brexit amendments are necessary as to the role of the UK supervisory authority and its relationship with the EU authorities for example.

The notes to the Queen's speech (page 46) underlined the importance of maintaining data flow from the EU after Brexit to "cement the UK's position at the forefront of technical innovation, international data sharing and protection of personal data." ​

The September Data Protection Bill

On September 14th 2017, the Data Protection Bill was published in the UK. The goal of this piece of legislation is to modernize data protection law in the UK for the years to come. 

However, it is important to note that the GDPR is applying in the UK as of May 25th 2018, the Data Protection Bill only applies where the GDPR leaves Member States opportunities to make provisions for how it applies in their country. 

The Data Protection Bill also concerns other topics than the provisions of the GDPR. The Information Commissioner’s Office (ICO), UK’s Data Protection Authority, explained that it is important to read the GDPR and the Data Protection bill side by side.   

Helping stakeholders

Moreover, the UK’s Data Protection Authority is helping stakeholders preparing for the entry into force of the GDPR by publishing a 12-step preparation plan​. The ICO also published a checklist aiming at helping stakeholders evaluate their readiness for the implementation of the GDPR. This checklist, based on the preparation plan is composed of five main topics: 
  • Accountability and governance
  • Key areas to consider
  • Individuals’ rights
  • Breach notification
  • Transfer of data 

GDPR France ​​

GDPR prep in France: a stakeholders’ consultation to identify difficulties 

In France, the Supervisory Authority for the General Data Protection Regulation is the Commission Nationale de l'Informatique et des Libertés (CNIL). The CNIL has been deeply invested in the preparation of the entry into force of the provisions of the Regulation as it occupied the Presidency of the WP29 until February 2018.

The CNIL launched a public consultation in France in June 2016 regarding the four priority subjects identified by the WP29:

  • New portability right
  • Notion of high risk, and Data Protection Impact Assessment (DPIA)
  • Certification
  • Data Protection Officer  
On March 2017, another consultation was launched regarding three other subjects identified by the WP29:
  • Violations notification
  • Consent 
  • Profiling
The goal of these public consultations was to invite feedback from the various actors working in the field of data processing and identify their difficulties regarding the new Regulation. The CNIL published its first summaries (I and II) of the responses received. These consultations aim at contributing to the thematic guidelines published by the WP29. 
The WP29 is made up of a representative from the data protection authority of each EU Member State, the European Data Protection Supervisor and the European Commission. 

A new consultation was launched on September 19th 2017 until October 19th. 

It aims at identifying issues regarding international data transfer and transparency. Its results​ will soon be published.

The CNIL keeps encouraging stakeholders to outline their difficulties, and raise questions regarding the entry into force of the GDPR through its website.  

Moreover, the "law for a digi​tal Repu​blic​" officially adopted by France on 8 October 2016 is already paving the way for the entry into force of the GDPR's provisions in the country.

More precisely, this law creates new obligations for data processing companies in line with the GDPR and, for example, permits the CNIL to impose sanctions of up to three million euros.  It is important to note that, after 25 May 2018, the provisions of the GDPR is applying when there is a conflict with the provisions of the "law for a digital Republic". 

GDPR in the Netherlands  

GDPR prep in the Netherlands: a 10-step plan to prepare stakeholders 

In the Netherlands, the Supervisory Authority for the GDPR is the Autoriteit Persoonsgegevens (AP). The AP, whose powers will become stronger with the new Regulation, is starting to prepare for the entry into force of its provisions.

To help companies based in the Netherlands prepare for the introduction of the GDPR on May 2018, the AP has declared itself available to answer all questions by phone or email.

Moreover, from June 2017, every month the AP will publish on its website the responses to the three most frequently asked questions regarding the implementation of the GDPR.

Moreover, the AP published in April 2017 a step-by-step plan aiming at helping stakeholders to prepare for the GDPR. This plan is composed of 10 steps: 
  1. Awareness
  2. Rights of individuals
  3. Records of processing activities
  4. Privacy Impact Assessment (PIA)
  5. Privacy by design & privacy by default
  6. Data Protection Officer (DPO)
  7. Data breach notification duties
  8. Data processing agreements
  9. Lead supervisory authority
  10. Consent

​The main data protection rules in the Netherlands were:

  • The "Dutch Data Protection Act" (WBP) which implemented in national law the European Union Data Protection Directive 95/46/EC on September 1 2001.
  • The "Breach Notification Law" of 2016. This is paving the way for some provisions of the GDPR, as it states that a data breach must be reported to the AP and that data subjects have to be informed about a data breach if it can have consequences for their privacy. 

​Biometric data protection in the United States

Biometric data protection in the United States 

​In the United States, there is no single, comprehensive federal law regulating the collection and use of personal data in general, or biometric data in particular. Instead, the country has a patchwork system of federal and state laws and regulations that can sometimes overlap or contradict one another.

But that's not all…

Government agencies and industry groups have developed self-regulatory guidelines, drawn from best practices and which are now taken into account by regulators.

Apple, Facebook, Google and Microsoft have been self-regulating for some time, even though these companies have been investing heavily in the creation of  powerful facial recognition technologies. Facebook, for example, has an agreement with the Federal Trade Commission. Under this, the company has to first obtain "affirmative express consent" before going beyond a user's specified privacy settings. 

According to Wikipedia, DeepFace, Facebook's facial recognition system, is said to be 97% accurate. This compares with 85% for the FBI's Next Generation Identification System.

Identification without consent in 47 states

As of July 2017, it is legal in 47 states for software to identify an individual using images taken without consent while they are in public. Illinois and Texas don't allow it for commercial use.

As of June 2017, Washington is the third state to pass a biometric privacy law. It covers any business entity that collects biometric identifiers for commercial purposes.

Facial recognition, for example, can be performed inconspicuously from a distance without the individual actively providing any information.

There's already facial recognition software that shops can use to signal pre-identified shoplifters or to identify customers that return goods too often. And it doesn't take much to imagine that - thanks to Facebook - these shops could easily get immediate information on their customers when they enter the store: who they are, where they live, income and/or credit score.

From a privacy perspective, these practices conflict with key principles such as anonymity, consent and purpose.

Let's dig a little deeper.

biometric law for Washington  

Many parties to address the issue

The question of consent and how to manage biometric data is sensitive, and it seems as if virtually every agency in Washington is addressing at least part of the issue:

  • The National Institute of Standards and Technology for the evaluation of biometric technologies.
  • The Federal Trade Commission for data security with the FTC Act (15 U.S.C. §§41-58). This consumer protection law prohibits unfair or deceptive practices. It's been applied to offline and online privacy and data security policies.
  • The Food and Drug Administration for the security of implants.
  • The Department of Health and Human Services with the Health Insurance Portability and Accountability Act (42 U.S.C. §1301 et seq.) for medical information.The HIPAA Privacy Rule of 2003 regulates the use and disclosure of Protected Health Information (PHI) held by "covered entities". They may disclose protected health information to law enforcement officials for law enforcement purposes and administrative requests; or to identify or locate a suspect, fugitive, material witness, or missing person.​

Three states have enacted a protection law for biometric identifiers and several others are debating one.

In particular, the California legislature debated a bill in 2015-2016 that would have expanded data security requirements for businesses that maintain personal information of California residents to include protection for geolocation and biometric data

Biometric information was defined in the bill as data generated by automatic measurements of an individual's fingerprint, voice print, eye retinas or irises, identifying DNA information, or unique facial characteristics, which are used by the owner or licensee to uniquely authenticate an individual's identity. However the bill failed to pass the Senate Judiciary Committee. 

There's more.

In July 2018, Microsoft President Brad Smith called for federal regulat​​ion for facial recognition software use and ​ urged Congress to study it ​and oversee its implementation.

This unusual blog post​ illustrates how powerful technologies involving artificial intelligence — such as facial recognition — have set off a controversial battle among tech executives.

So, clearly, US regulators have to increasingly focus on the use of biometric data. 

But let's move to India now.

India and the emerging global consensus on biometric data protection​ ​

India and the emerging global consensus on biometric data protection​

On 24 August 2017, India made it very clear as the Supreme Court ruled privacy a ‘fundamental right’ in a landmark case. This decision (​Puttaswamy judgment​) could impact the country’s biometric identification program known as Aadhaar​.

Privacy demands a rigorous accountability. We’re seeing the emergence of a global consensus, its fundamental principle being that mismanagement of personal information will not be tolerated and that companies that do not protect data properly could be hit with large fines.

Let’s hope that these new laws and regulations can keep pace with digital change.

​Gemalto and digital security

An expert in strong identification with more than 200 civil ID, population registration and law enforcement projects that incorporate biometrics, Gemalto is able to act as an independent authority in proposing and recommending the most suitable solution for each application.

Gemalto attaches a great deal of importance to the assessment of risks and to the capacity of private operators to manage such risks. Similarly, the legal and social implications are also very important.

Although Gemalto keeps an open mind with regard to biometric techniques, it remains no less convinced that, whatever the choice of biometric, this technology offers major benefits for guaranteeing identity.

For a broader view of privacy laws, we recommend Global Tables of Data Privacy Laws and Bills (2017 edition) by Graham Greenleaf, University of New South Wales, Faculty of Law.

You can also find more information in our April 2017 web dossier: eIDAS Regulation in 2017 – A pivotal year for digital services in the EU.​