Biometric data: Misuse, use, and collation

DOI: https://doi.org/10.58248/PN731

Biometric data is a type of personal information that allows the unique identification of a person.

Physical and physiological biometric data includes information on fingerprints or faceprints, while behavioural biometric data includes information on voiceprints or gait analysis.

Industry estimates suggest that the global “passwordless verification” market was worth over £12.5 billion in 2023 and is expected to reach a value of £46 billion by 2032. This is mostly due to increased adoption.

Unlike passwords, biometric data is linked to the physical or behavioural characteristics of a person. If stolen, it is impossible for a user to get new biometric characteristics.

Developments in artificial intelligence (AI) have made possible new uses of biometric data, including live facial recognition and emotion analysis. Academics and think tanks have expressed concerns that these new tools could require enhanced individual protections and further regulations.

• Biometric data is a type of personal information that allows the unique identification of a person. The most common forms of biometric data rely on fingerprints, face geometry, and voice.
• Biometric data is commonly used to unlock personal devices, speed up passport checks, or verify someone’s identity for online banking.
• According to a 2023 survey, 33% of respondents in the UK preferred biometric verification as a sign-in method over using a password or an authentication application.
• Biometric data is considered “special category personal data” under the Data Protection Act 2018 and receives extra legal protection. However, researchers and think tanks have indicated that additional legal safeguards may be required, for instance, for the use of modern biometric systems such as facial recognition.
• Developments in artificial intelligence have made new uses of biometric data possible. It has been suggested that personal information such as age, ethnicity, sexuality, or emotions, can be inferred from biometric data. This could have a range of ethical implications, including negative implications for privacy and other civil liberties.

POST is grateful to Vincent Saverat for researching this briefing, to the Engineering and Physical Sciences Research Council for funding his parliamentary fellowship, and to all contributors and reviewers. For further information on this subject, please contact the co-author, Dr Simon Brawley.

POSTnotes are based on literature reviews and interviews with a range of stakeholders and are externally peer-reviewed. POST would like to thank interviewees and peer reviewers for kindly giving up their time during the preparation of this briefing, including:

Members of the POST Board*

Matt Davies, Ada Lovelace Institute

Ian Deasha, Information Commissioner’s Office*

Professor Mark Elliot, University of Manchester

Professor Pete Fussey, University of Essex

Sam Jefferies, United Nations High Commissioner for Refugees
Thomas Jensen, Milestone systems A/S

Dr Nóra Ní Loideáin, Information Law & Policy Centre

Brian Plastow, Scottish Biometrics Commissioner*

Diego Quiroz, Scottish Biometrics Commissioner Office

Dr Birgit Schippers, University of Strathclyde

Bruce Schneier, Harvard Kennedy School

Samuel Stockwell, Alan Turing Institute

Madeleine Stone, Big Brother Watch

Kai Zenner, European Parliament

*denotes people and organisations who acted as external reviewers of the briefing.