Working Party on Information Security and Privacy

This report is intended to provide an understanding of the benefits and limitations of biometric-based technologies. It also includes information on existing privacy and security methodologies for assessing biometrics. It has been revised to take into account comments received from delegates following the October 2003 WPISP meeting in Oslo. The report has also been updated in a few areas. The report was prepared by Peter Hope-Tindall, Director and Chief Privacy Architect, dataPrivacy partners, a consultant to the OECD, under the supervision of the secretariat. Delegates are invited to submit their comments to the Secretariat by 27 February 2004 after which time, as agreed at the WPISP Oslo meeting, the document will be submitted to the ICCP Committee for declassification at its next meeting on 1-2 April 2004. 1. This report provides a general introduction to biometric technologies. It also discusses the various concerns raised by these technologies, with a focus on privacy and information security. 2. There is currently considerable interest and activity associated with the use of biometrics in many different areas such as banking, education and other public services as well as in the travel security context. Further biometric-based technologies hold the opportunity to identify individuals in remote network environments and through varied modalities of communications. Also the biometric industry has experienced substantial growth in the recent past and is expected to experience even more growth in the next five years. A number of biometric standards have been or are being developed to support the industry and the technology. World events and the search for a technological solution to the security problems that many have identified have increased the interest in biometric-based technologies and the biometric industry in general. 3. The world of biometric-based technologies brings with it new terms and concepts, an understanding of which is important to an informed discussion of the subject matter. The report introduces the following major biometric-based technologies:finger-scanning, hand geometry, facial recognition, iris scanning, retinal scanning, finger geometry, voice recognition and dynamic signature verification. A brief description of other, more obscure biometric-based technologies such as ear geometry, body odour measurement, keystroke dynamics and gait recognition is also provided. DNA-based technology, which is not strictly a biometric, but raises many of the same concerns as biometrics, is addressed in an annex. 4. All biometric systems operate in essentially the same manner. They capture a biometric sample, perform feature extraction or dataset creation and …