The Information Commissioner’s Office (ICO) has published a draft version and opened a consultation on new guidance in the use of biometric data.
It includes a strong emphasis on the data protection requirements and is accompanied by a draft summary economic impact assessment.
The consultation will be open until 20 October, to be followed by a second phase that will include a call for evidence.
The draft guidance document has been produced for organisations that use or are considering the use of biometric recognition systems and their suppliers. It looks how the data relates to the UK General Data Protection Regulation.
It does not cover requirements for law enforcement or the security services, but cites education among the areas in which the use of the technologies is expected to grow.
Requirements
It provides an outline of biometric recognition, stating that this involves using personal by default and comes with a series of requirements in regard to protection. These include complying with the relevant law when using biometric data, taking a data protection by design approach, and carrying out a data protection risk analysis before use.
The document says that explicit consent is likely to be the only valid condition for processing special category biometric data – which is aimed at uniquely identifying an individual – and other conditions may apply depending on the specifics of the proposal.
