Lorenz gave a presentation on the legal aspects of biometrics at the Annual European ITechLaw Conference which was held in Brussels on November 5-6, 2009. Biometrics are gaining importance to adequately secure physical access as well as access to information systems. However, the implementation of biometric technology on the European market requires that a number of legal hurdles are successfully overcome by the biometrics industry and companies planning to invest in such technology.

1. Lorenz
1
Brussels Bishkek Geneva

2. 2
Table of Contents
LorenzBrussels Bishkek Geneva
I. Introduction to Biometrics
II. Privacy Protection under Regulatory Regimes
III. Other Legal Issues
A. Biometrics in the Workplace
B. E-commerce
C. Evidence
D. Standardization
IV. Concluding Remarks and Questions

3. I. INTRODUCTION TO BIOMETRICS
Brussels Bishkek Geneva 3
Lorenz

4. WHAT IS ‘BIOMETRICS’?
1. Characteristic: The measurement of (i) psychological or (ii)
behavioural characteristics of an individual, for use in proving
their identity.
2. Process: The automated method of recognizing an individual
based on measurable characteristics.
Brussels Bishkek Geneva 4
Lorenz

5. Brussels Bishkek Geneva 5
Lorenz
1. Sensor
2. Biometric Template
3. Data storage Components
4. Matching Algorithm
5. Decision Process
How does a biometric system work?

6. Practical uses of biometric technology
1) Logical access – information and assets
2) Physical Access – facility or location
Brussels Bishkek Geneva 6
Lorenz

7. Verification Versus Identification
Verification systems compares sample to previously
submitted templates.
1 = 1
Identification systems try to determine who the
individual is by comparing to a closed set or open
set of data.
1 = multiple
Brussels Bishkek Geneva 7
Lorenz

8. Characteristics Biometric Elements:
- Universality
- Uniqueness
- Permanence
- Accessibility and ability to be quantified
Lorenz

9. Common Characteristics of Biometric
Recognition Systems
-System Performance (error rates)
-User Tolerance
-Robustness
-Interface Ability
Lorenz

10. Fingerprint recognition
Brussels Bishkek Geneva 10
Lorenz
http://www.biometricsinfo.org/images/finger3.jpg

11. Hand and Finger Geometry
Brussels Bishkek Geneva 11
Lorenz
http://www.theage.com.au/news/national/schools-to-fingerprint-students-for-security/2007/09/01/1188067438565.htmlhttp://www.sandiacontrolsystems.com/img/HGU.jpg

12. Brussels Bishkek Geneva 12
Face Recognition
Lorenz
http://news.bbc.co.uk/2/shared/spl/hi/guides/456900/456993/html/nn2page1.stm

13. Speaker Recognition
Brussels Bishkek Geneva 13
Lorenz
http://www.acm.org/crossroads/xrds3-3/gfx/sound.jpg

14. Brussels Bishkek Geneva 14
Iris Recognition
Lorenz
http://www.cytrap.eu/files/ReguStand/2007/image/2007-11-28_iris-recognition-biometric-
passport.jpg

15. Brussels Bishkek Geneva 15
Iris Recognition
Lorenz
http://www.cl.cam.ac.uk/~jgd1000/iriscollage.jpg
http://www.cytrap.eu/files/ReguStand/2007/image/2007-11-28_iris-recognition-biometric-passport.jpg

16. Brussels Bishkek Geneva 16
Lorenz
Biometric Passports
http://www.scienceprog.com/wp-content/uploads/RFID/e-passport.JPG

17. Brussels Bishkek Geneva 17
• Dynamic signature
• Keystroke dynamics
• Circulatory recognition
• Gait/body recognition
• Facial thermography
• DNA recognition ?
• Etc.
Lorenz
Developing biometric technologies

18. Brussels Bishkek Geneva
Government uses:
• E-passports
• National Security
• Transportation: Airport/airline
travel
• Immigration
• Information Security
Private sector uses:
•Hardware
•Information Security
•Domestic Uses
•Health care
•HR Purposes
•Assets
18
Brussels Bishkek Geneva
Lorenz
Current Uses in the Market

19. II. BIOMETRICS AND EUROPEAN PRIVACY
Brussels Bishkek Geneva 19
Lorenz

20. European Context
- Right to data protection
- Right to privacy
- Human right approach
Brussels Bishkek Geneva
20
Lorenz

21. Brussels Bishkek Geneva
21
LorenzBrussels Bishkek Geneva
Biometrics and Human Rights

22. Generic Concerns Article 29 Working Party
- Special sensitivity biometric data :
- behavioural and physiological characteristics of an individual
- Unique identification
- Potential re-use (both private and public sector actors)
- Potential desensitization
Brussels Bishkek Geneva
22
Lorenz

23. Brussels Bishkek Geneva
Purpose and Proportionality
- Impact on legitimacy of biometric process used in a specific context (e.g.
Storage of reference information; raw data may contain unnecessary
information)
- Affected population (in terms of quantity and quality)
- Public sector uses v. Private sector uses
Brussels Bishkek Geneva
23
Lorenz

24. Brussels Bishkek Geneva
Other Issues
• Fair collection and information
• Criteria for making data processing legitimate
• Prior Checking – notification requirements
• Security measures
• Sensitive data
• Unique identifier
Brussels Bishkek Geneva
24
Lorenz

25. Interpretations by member state DPAs
Brussels Bishkek Geneva 25
Lorenz

26.  No harmonized approach (country by country)
 Gradually but slowly more acceptance of biometrics
technology
 Factors:
 DPAs tend to be sceptical about storing templates in a central
database
 DPAs promote the use of biometric applications that do not “leave
traces”
 DPA are more lenient towards public sector purposes (private sector
purposes typically require stronger justification)
Lorenz

27. Potential Bottlenecks For Companies
- Biometrics technology industry
- Users of biometrics technology
Brussels Bishkek Geneva
27
Lorenz

28. III. OTHER LEGAL ISSUES
A. BIOMETRICS IN THE WORKPLACE
B. E-COMMERCE AND CONTRACTS
C. POSSIBLE CONTRACTUAL ISSUES
D. EVIDENCE
E. STANDARDIZATION
Brussels Bishkek Geneva 28
Lorenz

29. Brussels Bishkek Geneva
29
A. Biometrics in the workplace
LorenzBrussels Bishkek Geneva
http://pagesperso-orange.fr/fingerchip/biometrics/fun/security4.gif

30. Biometrics in the workplace (continued)
 Need for employer to secure premises and IT Network
(physical and logical access control)
 Monitoring of employees (e.g. prevention of ‘buddy
punching’)
30
Lorenz

31. Biometrics in the workplace (continued)
• Privacy Issues:
– Legitimacy of specific use of biometrics
– Biometric information stored in central database or on individual
carriers (e.g. badge)?
– Are some biometric data to be considered as sensitive data
(containing information on race, health,...)?
• Consultation Issues
– Introduction of biometric system may have impact on the work
organisation and the privacy of employees
– Involvement of employee representative bodies
Lorenz

32. Brussels Bishkek Geneva
B. Biometrics and E-commerce
Ability to identify the purchaser?
• Better than passwords
Industry is slow to embrace biometric technology
Costs
• Non-portability of devices
 Alternatives such as keystroke dynamics and speaker recognition could
solve these issues.
Brussels Bishkek Geneva
32
Lorenz

33. Brussels Bishkek Geneva
Biometrics and E-commerce continued
Brussels Bishkek Geneva
33
Lorenz

34. Brussels Bishkek Geneva
C. Possible Contractual Issues
1. Liability
2. Malfunctions and technical problems
Brussels Bishkek Geneva
34
Lorenz

35. Brussels Bishkek Geneva
D. Evidence
Brussels Bishkek Geneva
35
Lorenz
http://aftermathnews.files.wordpress.com/2008/08/biometric_passport.jpg

36. Brussels Bishkek Geneva
Brussels Bishkek Geneva
36
Lorenz
Outstanding problems with biometrics as evidence:
1.Lack of harmonization
2.Advantages and disadvantages experts
3.Right to counter-expertise
4.Rights of second experts

37. Brussels Bishkek Geneva
E. Standardization
Brussels Bishkek Geneva
37
Lorenz
•National and International efforts for standardization of
biometrics and biometric systems
•International Standardizing Organization in cooperation with
the International Electro-technical Commission publishes
standards
•Importance of interoperability of systems

38. Brussels Bishkek Geneva
IV. CONCLUDING REMARKS AND
QUESTIONS
Brussels Bishkek Geneva 38
Lorenz

39. Brussels Bishkek Geneva
39
Jan Dhont
j.dhont@lorenz-law.com
Steven De Schrijver
s.deschrijver@lorenz-law.com
Lorenz
Troonstraat 14-16 B. 5 Rue du Trône
1000 Brussels
T. 32 2 239 2000 - F. 32 2 239 2002
www.lorenz-law.com
Lorenz