Consider the Ethical Ramifications (7/7)

This is the last of seven vendor suggestions I made in my Biometric Update guest post.

“Consider the ethical ramifications. Sometimes we as an industry are so intent on getting things done that we don’t pause to consider the ramifications of our actions. Those companies that address the ethical ramifications of biometrics, artificial intelligence, machine learning, and other technologies are well-positioned for future challenges.”

Ideally ethical considerations should happen in the executive suite, not in some superfluous subcommittee that could get axed any day. As a positive example, Tony Porter OBE QPM LLB has served as Chief Privacy Officer of Corsight AI since January 2021.

(Imagen 3)

Employ Security (6/7)

This is the sixth of seven vendor suggestions I made in my Biometric Update guest post.

“Employ comprehensive security measures. Ensure protection for the data on your systems, your customer systems, and the systems integrated with those systems. Employ third-party risk management (TPRM) to minimize the risk when biometric data is stored with cloud providers, application partners, and companies in the supply chain.”

If you don’t already know this, whenever you read a Bredemarket-authored article, always click the links. This includes the articles I write for others…such as Biometric Update. If you clicked a particular link at the end of my guest post, you found out which third party behaved badly with Customs and Border Protection (CBP) data:

“Facial images of travelers and license plate data have been stolen from a U.S. Customs and Border Protection (CBP) subcontractor….While the agency did not identify the subcontractor to the Post, it did provide a statement titled “CBP Perceptics Public Statement.”…Perceptics was hacked in May, and The Register reported thousands of files…were available on the dark web.”

As I concluded my guest post,

“Do not let this happen to your business.”

But here’s a positive example:

“ID.me will transfer your Biometric Information to our third party partners only when required by a subpoena, warrant, or other court ordered legal action.”

(Imagen 3)

Disclose Data Uses (5/7)

This is the fifth of seven vendor suggestions I made in my Biometric Update guest post.

“Disclose the specific uses for all biometric data you control and/or collect. The law often requires this anyway, but even if it isn’t, educate your customers and their users regarding why you collect what you do.”

As an example, Built In notes that Illinois’ Biometric Information Privacy Act (BIPA) has strict consent requirements, including the following:

“Informing the individual of the company’s purpose for collecting, storing, and using the biometric information.”

(Imagen 3)

Comply with Privacy Requirements (4/7)

This is the fourth of seven vendor suggestions I made in my Biometric Update guest post.

“Comply with all privacy laws and regulations. This should be a given, but sometimes vendors are lax in this area. If your firm violates the law, and you are caught, you will literally pay the price.”

Ask companies doing business in the GDPR region, Illinois, Texas, and elsewhere how hefty those fines could be. Meta alone has received billions of dollars of fines in Ireland (EU) and over a billion dollars in Texas.

(Imagen 3)

Store the Minimum (3/7)

This is the third of seven vendor suggestions I made in my Biometric Update guest post.

“Store only the minimum necessary personal information. If you don’t need to keep certain data, don’t store it. I’m sure our decentralized identity friends will agree with this.”

Take one such company, Anonybit.  Did you ever wonder how Anonybit got its name? Here’s what Anonybit does with biometric data after capture:

“Convert biometric into sharded, anonymized bits (“anonybits”)

“Distribute the “anonybits” throughout the multi-party cloud environment for storage, where they are kept and never retrieved or reassembled, even for matching”

(Imagen 3)

Collect the Minimum (2/7)

This is the second of seven vendor suggestions I made in my Biometric Update guest post.

“Collect only the minimum necessary personal information. If you don’t need certain data, don’t collect it. If it’s never collected, fraudster hackers can never steal it.”

Let’s pick on Workday. Job applicants know why. Workday’s default configuration (which many companies don’t change) is to require job applicants to set up an account with login and password.

But what happens to that data when—not if—Workday is hacked?  

(Imagen 3)

Exercise Transparency (1/7)

Get ready for repurposing gone wild. This is the first of seven vendor suggestions I made in my Biometric Update guest post.

“Exercise transparency. Remember that some people are convinced that every piece of data collected by every biometric vendor is fed into a super-secret worldwide surveillance supercomputer maintained by shadowy forces. If you don’t educate your customers and their users on the truth—how data is shared, and how data is not shared—they will believe the lies.”

For example, many companies love to make money by selling your data. ID.me makes it very clear that it does not do this.

“ID.me will not sell, rent, or trade your Biometric Information, and after verification you may request we delete your Biometric Information.”

(Imagen 3)

Writers Must Disclose Responsible Contributions of Biometric Governance Opinions

You knew that I was going to link to THIS Biometric Update post, because…well, I wrote it.

You can read “Opinion: Vendors must disclose responsible uses of biometric data” here: https://www.biometricupdate.com/202505/opinion-vendors-must-disclose-responsible-uses-of-biometric-data

Excerpt:

“Usually, the government agency or private organization acts as the “controller” or owner of the biometric data, while the biometric vendor is just the “processor” of the data.

“But there are exceptions. In late April, Joel R. McConvey described a proposal in which the Milwaukee, Wisconsin Police Department would provide Biometrica with 2.5 million facial images from its jail records.

“Why would any biometric vendor want to be the controller of biometric data? One plausible reason is for internal testing to improve the vendor’s algorithms by continuously testing them against live data. There may be other reasons, such as offering new services.”

But this is actually the SECOND time I have been featured by Biometric Update. If you check its YouTube channel, you can find the 2015 gem “MorphoTrak (Safran) – MorphoWay demo”: https://youtube.com/shorts/mqfHAc227As

Stay tuned for my next Biometric Update appearance in 2035.

Verify the Supporting Documents Aren’t Forged

From the CBC in Canada:

“The documents were forged Labour Market Impact Assessments, or LMIAs. Employers typically receive the documents from Employment and Social Development Canada (ESDC) if they want to hire a foreign worker.”

Biometrics aren’t enough. The person may be who they say they are, but the documentation they are holding may be fake.

More on this type of fraud: https://www-cbc-ca.cdn.ampproject.org/c/s/www.cbc.ca/amp/1.7516048

(Forged document from Imagen 3. Lincoln never held a law license in the then-United Kingdom.)