More than three years ago, a Take on Payments post discussed some of the social benefits biometrics technology offers. The post highlighted work by Michigan State University's Distinguished Professor and biometrics expert Anil Jain on a project
in India showing how the capture of an infant's fingerprints over the age of six months can be used to identify that child on future visits to ensure that the child had received vaccinations and other care.
Since that time, biometric authentication has found its way into a growing number of financial and nonfinancial applications. We are all familiar with the use of fingerprint or facial recognition to unlock applications on our smartphones. At our hometown Atlanta airport and airports across the nation, the Transportation Security Administration (TSA) has improved the efficiency of the TSA PreCheck process by using technology that compares the photograph on your identification document (passport or driver's license) to an image of your face captured by a high-definition camera at the officer's station, eliminating the need for you to produce your boarding pass. Not only is the system making sure that the images match, but it also verifies that you have PreCheck clearance and are scheduled on a flight out of that airport on that day.
The COVID-19 pandemic has also led to the development of a number of applications using various combinations of such technologies as facial recognition, thermal imaging, and geolocation. A number of airports in the United States are using thermal imaging to detect passengers with a fever. Some countries have used a combination of these three technologies to detect that a person has a fever, identify that person, and track that person to determine who they might be infecting. (Of course, an individual can have a fever for other reasons.)
This particular use of the applications has led to concerns about privacy rights in those countries. While contact tracing can provide a social benefit in helping identify additional individuals that could become infected, what are the privacy rights of the ones being tracked? The greatest threat is when biometrics and other data are being collected without an individual's knowledge. Who has access to that information, how else it is being used and how long will it be retained?
In the United States, a number of states (including Illinois) have biometrics information privacy laws, but rights and responsibilities are inconsistent from state to state. The Health Insurance Portability and Accountability Act, or HIPAA, provides additional safeguards for the privacy of a person's medical information. But how do you balance the privacy rights of the individual against the need for the overall safety of the general public?
David Lott, a payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed