Biometric data in financial services: existing law, deep fakes, and the UK ICO's draft guidance

• For comparison, Illinois’ BIPA defines ‘biometric identifier’ as ‘a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry‘ before listing items that are not biometric identifiers. This is a very different definition to GDPR.

UK ICO’s draft guidance

The draft guidance parses down GDPR’s definition of biometric data into three elements, namely that biometric data:

1. ‘relates to someone’s behaviour, appearance, or observable characteristics (e.g., the way someone types, a person’s voice, fingerprints, or face);
2. has been extracted or further analysed using technology (e.g., an audio recording of someone talking is analysed with specific software to detect things like tone, pitch, accents and inflections); and
3. can uniquely identify (recognise) the person it relates to‘.

Examples of physical or physiological biometrics from the draft guidance include: ‘a person’s facial features, fingerprints, iris, voice and even their ear shape’.

Examples of behavioural characteristics from the draft guidance include: a person’s handwriting or method of typing, their gait when walking or running, or their eye movements.

‘Specific technical processing‘ is clearly met by using biometric software security tools as they analyse or digitally represent biometric data to compare it to stored values.

The importance of purpose

What is interesting is that, while ‘biometric data’ already has identification baked into its definition, that data is still not yet ‘special categories biometric data’ covered by Article 9 of GDPR — that requires purpose.

Special categories of personal data are set out in Article 9(1) and include (author’s emphasis): ‘biometric data for the purpose of uniquely identifying a natural person‘.

The ICO confirms that what turns biometric data into special categories biometric data is a person’s purpose for processing that data, which makes biometrics unique among special categories.

Help on legal basis

If a firm does wish to process special categories biometric data, it needs an exemption under Article 9(2). The ICO notes that, ‘In most cases, explicit consent is likely to be the only valid condition for processing special category biometric data.‘ However, consent is hard to use, particularly when there is a power imbalance such as in an employment relationship.

The ICO’s draft guidance highlights other bases that financial service firms should consider with their legal advisers, such as necessary for the ‘prevention and detection of unlawful acts’. The draft guidance states that this condition applies if:

• a firm needs to use biometric data for crime prevention or detection purposes; and
• asking for people’s consent means the firm would not achieve those purposes.

Consent can always be withheld or later withdrawn, making it an inappropriate legal basis for strategic use.

Eight action points

1. Audit where the business wishes to use — and already uses — biometric data in the organisation anywhere in the world. Identify the purpose of each processing activity and all relevant context.
2. Identify relevant, applicable laws.
3. If the business is covered by UK or EU GDPR, or a modern comprehensive Privacy law in a U.S. state, carry out a data protectionimpact assessment or risk assessment.
4. Decide on the appropriate legal basis for each of those processing activities:
   1. For example, consent may be the only option in some cases (in which case a different option must be provided to individuals who do not consent) and prevention and detection of unlawful acts may be appropriate in others.
   2. Where the firm does not use consent, document why the processing of special category biometric data is ‘necessary’ for your chosen legal basis (such as the prevention and detection of crime and for reasons of substantial public interest).
5. Document how the firm’s use of biometric data is targeted and proportionate ‘to deliver the specific purposes set out in the condition, and that you cannot achieve them in a less intrusive way’.
6. Document how the firm has investigated how the solution avoids bias in this particular situation with these particular individuals.
7. Make sure, as required, that the firm has an appropriate policy document for UK GDPR and appropriate policy for BIPA.
8. Provide prior information to individuals to meet the firm’s transparency obligations.

Robert Baugh is the founder and CEO of Keepabl, privacy management SaaS based in London. Prior to Keepabl, Robert was general counsel of technology growth companies for more than a decade.