“Biggest ever deletion of biometric IDs from a state-held database” to be carried out by UK tax authority

The UK’s Information Commissioner’s Office (ICO) has ruled the collection of voice biometric data from roughly five million people by the country’s tax authority is in violation of the EU’s General Data Protection Regulation, and therefore the records must be deleted, ZDNet reports.

HM Revenue and Customs (HMRC) implemented a system in 2017 which appears to use Nuance voice biometrics, and had collected seven million voiceprints after two years, with 160,000 opt-outs. The agency had collected the first 5 million or so with an opt-out system that was neither presented nor simple, according to Big Brother Watch.

Big Brother Watch filed a formal complaint, and the ICO launched an investigation. ICO Deputy Commissioner Steve Wood blasted HMRC’s implementation.

“We welcome HMRC’s prompt action to begin deleting personal data that it obtained unlawfully,” Wood says. “Our investigation exposed a significant breach of data protection law – HMRC appears to have given little or no consideration to it with regard to its Voice ID service.”

Wood also recently wrote the ICO’s submission to parliament’s Science and Technology Committee that UK police should not roll out live facial recognition until its legal footing and necessity are clarified.

HMRC says it will keep only the 1.5 million Voice ID records collected with explicit consent since changes were made in October, 2018, to comply with GDPR. The agency says the rest of the records will be deleted before the June 5 deadline set by the ICO is reached.

“To our knowledge, this is the biggest ever deletion of biometric IDs from a state-held database,” Big Brother Watch Director Silkie Carlo said, according to ZDNet. “This sets a vital precedent for biometrics collection and the database state, showing that campaigners and the ICO have real teeth and no government department is above the law.”

HMRC reports that despite the setback, Voice ID is popular with users, and that it will continue using its now-compliant implementation.

The UK Home Office is yet to carry out the deletion of face biometric images from its database as ordered by the High Court in 2012.

Article Topics

Big Brother Watch  |  biometric database  |  data collection  |  privacy  |  UK  |  voice biometrics