UK ICO warns biometric tools may pose privacy, compliance risks

The UK Information Commissioner’s Office (ICO) has issued a two-pronged warning about using biometric technologies. They want the public to know that new products and services using biometric data might not have sufficient privacy safeguards. And businesses need to be aware of proportionality, accuracy and bias issues before deploying biometric technologies.

A report from MLex quotes Stephen Almond, who leads the technology and innovation department at the ICO, speaking at a recent UK data protection conference: “I really recommend for those of you who are looking at uses of biometric technologies, which are often presented as this great time-saving mechanism at work, to actually pause and just think,” Almond says.

While the sales pitch for biometrics might sound great, customers need to ensure the tools they’re deploying meet standards and adhere to guiding principles – for example, “are we really meeting those expectations around proportionality?” and “are we giving people the sorts of choices and presenting this in a way where we could demonstrate that there is freely given consent?”

To help businesses navigate questions like these, the ICO plans to launch a new strategy on AI and biometrics in the spring. It is also working on a statutory code of practice on AI and automated decision making, which Almond says “is clearly going to span all of this territory as well.”

Hunger for biometrics among businesses as regulators define roles

Warnings are well and good, but data privacy advocates say UK privacy regulations still leave too much room for fishy operators. At the same conference as Almond, Michael Birtwistle, a director for law and policy at the Ada Lovelace Institute, speaks of an “appetite from private-sector organizations to use biometric recognition, particularly in the retail context.”

Birtwistle is pushing for more robust thinking on what regulations on biometrics are trying to achieve, or prevent – and a clearer picture of how various facial recognition use cases, from policing to retail, “stack up.”

The question of who should regulate what, and what exactly is being regulated, are top of mind for both policymakers and UK businesses, who have been promised a robust digital economy shaped by regulations.

The ICO’s answer to the question of who is best positioned to regulate is: we are. Almond says the data protection regulation is “perfect for governing the digital economy” and that, speaking to Birtwistle’s concerns, it is “working out actually just how far do some of our existing regulatory levers go in tackling harms.”

But it is balancing its pitch with a commitment to economic growth, in line with a UK government request for regulators to submit plans that demonstrate a path to an expanded digital economy.

Industry says tech rollouts not enough; only adoption drives growth

To no one’s surprise, the tech industry also favors tech regulations that drive adoption. MLex also covers recent comments addressed by UK tech industry experts to Parliament’s Business and Trade Committee. The thrust is that “regulatory stability, flexibility and guidance” will be needed to help the government achieve its promised growth.

Strong digital infrastructure is another piece, as is better coordination and efficiency among government departments.

Paul Morris, head of government affairs at Vodafone, says UK lawmakers should “best attempt to move quickly on the regulatory and policy structure and incentives and procurement to make sure that we’re getting to common goals.” A strategy that stops at rollout without following through to genuine technological adoption is missing the mark. “Adoption of technology will drive productivity across the public and private sector,” Morris says – “which should drive growth.”

Antony Walker, deputy CEO at technology industry group TechUK, wants high-growth companies facing regulation across multiple markets to be given extra help. Skills support is a start, Walker says, “but also we think there’s a potential to provide more of a kind of concierge service for them to help some of those very, very high growth potential companies navigate their way through regulation.”

Walker also cautions against betting the whole farm on AI – a key component of the government’s plan for economic growth. Specifically, he believes quantum computing should be getting attention, and that AI is part of a larger matrix, all of which is necessary to achieve the government’s goals: “AI and quantum are intrinsically linked. AI and infrastructure are intrinsically linked. AI and skills are all intrinsically linked.”

“Cross-departmental coordination is the hardest bit,” he says – “the bit that we really want government to focus on.”

Article Topics

biometric identifiers  |  biometric-bias  |  biometrics  |  data protection  |  Information Commissioner’s Office (ICO)  |  regulation  |  retail biometrics  |  standards