Biometrics and the challenge to human rights in Europe. Need for regulation and regulatory distinctions

Abstract

This report calls for regulation. With biometric applications gradually rolling out in the public and private sector, legislation, even detailed legislation, on the use of biometrics might make compliance to general data protection principles more likely than it is today. A regulatory distinction needs to be made between large scale information systems at EU level and others. The former are in need of tailor made data protection solutions and require (with every new system added or altered) a separate parliamentary and democratic debate. The latter are in need of guidance and best practices, which once found, should be better enforced. Today codification of best practices as developed by DPA's and other regulatory or supervisory authorities becomes a possibility. We see no good reason not to affirm that public or private controllers of data should not store raw data (because it is unique and therefore dangerous), not collect fingerprints (because fingerprints leave traces and are not accepted by many), not store biometrics in a central database (there are alternatives), or should encrypt biometric data used for processing, should use multiple authentications, should offer alternative schemes of authentication when biometrics are asked on basis of consent, should in case of a rejection, as a result of a biometric system, be obliged to re-examine the case and should, where necessary, offer appropriate alternative solutions. It is true that the technical possibilities of biometrics make its assessment complex, but by making the right regulatory distinctions this can be overcome.