ICO Drafts Biometric Data Guidelines, Seeks Input

In the UK, the Information Commissioner's Office (ICO) has published draft guidance concerning the gathering and use of biometric data, offered for public comment and consultation between now and 20th October.

The draft guidance, which follows an initial consultation with bodies including a British Youth Forum and Citizens' Biometrics Council, explains how data protection law applies when organisations or individuals use biometric data in biometric recognition systems. The law currently categorises biometric data, including face analysis, retinal / iris scanning and voice recognition / analysis, as 'special category personal data', requiring adherence to additional requirements when it is processed, on top of those for other types of personal data.

A number of key items are clarified in the draft guidance. Processors of biometric data are highly likely to be required to conduct a data privacy impact assessment (DPIA) before commencing their activities, and the explicit consent of the data subject is likely to be the only valid condition for processing biometric data - without which processing will be unlawful.

A second phase of consultation, focused on biometric classification and data protection, will include a call for evidence early next year.

Web site: www.ico.org.uk , with thanks to www.lexology.com for interpretation.