ICO consults on biometric data guidance

The ICO is currently seeking views on the first phase of its draft guidance on biometric data.

As the use of biometric technologies on mobile devices is becoming increasingly common, and biometric recognition is used across many sectors from banking to education, the ICO considers that it needs to clarify the terminology in use and issue specific data protection guidance.

The ICO says that not all biometric data is “special category biometric data.” This is only if organisations use it to uniquely identify someone. However, in these cases organisations should conduct a Data Protection Impact Assessment as using special category biometric data is likely to result in a high risk, the ICO says.

In most cases, explicit consent is likely to be the only valid condition for processing available to process special category biometric data, the ICO stresses.

The draft guidance puts much emphasis on security and fairness, and how to deal with risks of discrimination.

“Like other technologies which use AI, biometric technologies are susceptible to bias and discrimination. This is because systems designed to detect physical characteristics (e.g. fingerprints) need to manage a far greater range of variables than if they are detecting a uniform object (e.g. a swipe card).”

The second phase of this guidance (biometric classification and data protection) will include a call for evidence early next year.

The consultation will close on 20 October 2023.