We're looking into adding Biometric Access Control products into our line, particularly fingerprint readers, and wondered if anyone had encountered issues regarding privacy concerns? Specifically objections from workers not wishing the company to hold employee fingerprints in a database. Any thoughts from the legal minds among us? It would help to anticipate any potential problems first.
Subscriber Discussion
Privacy Objections To Biometrics
Brian Rhodes
Sep 16, 2013Hello Barry:
It seems that many implementing biometrics sidestep legality concerns by making adoption "voluntary" vs. "compulsory".
For example at a local US Air Force base, an employee has the choice to use a fingerprint reader, OR they have the choice to ring a guard 30 minutes prior to a shift, wait for the guard to arrive, have credentials manually validated, and then they are escorted through the opening.
Obviously, the adoption of the biometric reader option is 100%.
JH
John Honovich
Sep 16, 201324 Hour Fitness uses fingerprints for its ~3 million members and while a google search revealed a few internet complaints, it's been used for more than 3 years without any major problem / significant objection.
BS
Barry Shaw
Sep 16, 2013Thanks John. I'm thinking more along the lines of Unions getting involved. Still ultimately that's up to the customer to sort out, I was just looking to see if any precedents had been set or court rulings made.
Luis Carmona
Sep 16, 2013It may be a matter of exactly how the fingerprint information is stored. We're an integrator who uses Facekey fingerprint products. According to Facekey, fingerprints are converted to an encrypted algorithm before they are stored in the database. The fingerprint itself is not at snap shot picture, and there's no way a fingerprint can reconstructed from the database, even if the encryption key was broken, since it's an algorithm and not a picture.
JH
John Honovich
Sep 16, 2013Pretty much every fingerprint provider I have ever seen claims to do the same thing (stored as encrypted pattern rather than image).
I am not as confident that there is 'no way a fingerprint can be reconstructed from the database'. If you knew the encryption type, key and method the fingerprint provider mapped the print, you should be able to recreate.
Luis Carmona
Sep 16, 2013May be a possibility, I'm not a mathematican or cryptologist, but I have a feeling it would not be any more insecure than your date of birth and social security number which is on file with your employer. I think those are at more risk than fingerprint data.
For example, and maybe a little off topic, but I feel maybe puts in perspective the risks to "private" information; when I worked in the mailroom of another business in my early work experiance, the business office would give us copies of the list of employees so we could sort incoming mail. We'd get a new list every now and then and throw the old one out. One day it occured to me that there were social security numbers along with names and departments people worked in. I mentioned it to someone and soon after the reports were generated without the social security numbers.
JH
John Honovich
Sep 16, 2013There are certainly many security risks. Indeed, I think that floating social security numbers and credit card info is a far more common, practical risk than anything related to access control.
BS
Barry Shaw
Sep 16, 2013Thanks for the responses. Interesting topic though right?
JH
John Honovich
Sep 16, 2013Interesting indeed. I suspect fingers are culturally less sensitive than faces or eyes/irises, which people tend to hold more personal than a fingertip. For example, I think a face reader would draw more privacy concerns. Indeed, the US FTC's recent best practices for facial recognition puts restrictions on its use.
Brian Rhodes
Sep 16, 2013I believe it is going to be increasingly difficult for someone to 'conscientiously object' to biometric authentication.
In your example, a Labor Union may object to 'being forced' to have biometric details gathered/stored in a database, but how many of those Union members voluntarily use biometrics credentials elsewhere in life - like (John H mentions) at the gym, on cars, or on a personal smartphone/ laptop?
When there is willingness to use biometrics in one aspect of life, righteously objecting to others appears to be a slippery slope.
New discussion
Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.
Newest discussions