Biometrics: Facial, Speech, Fingerprint and DNA

Biometrics: Facial, Speech, Fingerprint and DNA (CIPT Privacy Risk Management)

Overview
Biometrics are measurable physical or behavioral characteristics used to identify or verify a person automatically. In the IAPP CIPT (Certified Information Privacy Technologist) body of knowledge, biometrics appear under privacy risk management. A technologist must understand how the systems work and why they carry higher privacy risk than most other personal data. The four types emphasized are facial recognition, speech/voice recognition, fingerprint recognition and DNA analysis.

Why It Is Important
Biometric data matters for several reasons:
• It cannot be changed. A leaked password can be reset. A leaked fingerprint, face or genome cannot. A breach therefore causes lasting harm.
• It is uniquely identifying. Biometrics link digital activity directly to a physical person. This erodes anonymity and allows tracking across contexts.
• It is often collected without awareness. Faces and voices can be captured remotely, passively and covertly, for example by CCTV, smart speakers or social media photos. This raises transparency and consent problems.
• It can reveal secondary information. Facial images can suggest ethnicity, age, health or emotional state. Voice can reveal mood, illness or origin. DNA reveals ancestry, disease predispositions and family relationships.
• Regulators treat it as sensitive. Examples include:
  - GDPR Article 9: biometric data used to uniquely identify a person is a special category.
  - Illinois BIPA: written consent, a retention schedule and no sale of data, with a private right of action.
  - Texas CUBI and Washington's biometric statute.
  - CCPA/CPRA: biometrics are sensitive personal information.
  - The EU AI Act: restrictions on remote biometric identification.
• Errors can cause real harm. False matches can lead to wrongful arrest or denied access. Demographic bias in algorithms creates discrimination risk.

What It Is: Key Concepts
1. Physiological vs. behavioral biometrics
• Physiological: what you are, such as face, fingerprint, iris, DNA, hand geometry.
• Behavioral: how you act, such as voice patterns, gait, keystroke dynamics, signature.
• Voice is often classed as both, because vocal tract shape is physical and speaking patterns are behavioral.

2. Identification vs. verification (authentication)
• Verification (1:1): Is this person who they claim to be? A live sample is compared with one stored template, as in phone unlock.
• Identification (1:N): Who is this person? A sample is compared against a whole database, as in surveillance watchlists.
• Identification carries far greater privacy risk. It needs large central databases and enables surveillance.

3. Templates
Most systems do not store raw images or recordings. They extract features into a mathematical template, such as fingerprint minutiae points or a facial feature vector. Templates are less risky than raw data but are still personal data. Some research shows templates can be partially reconstructed or linked across systems.

4. Accuracy metrics
• False Acceptance Rate (FAR) / False Match Rate: an impostor is wrongly accepted. This is a security failure.
• False Rejection Rate (FRR) / False Non-Match Rate: a legitimate user is wrongly rejected. This is a usability failure.
• Crossover Error Rate (CER) / Equal Error Rate (EER): the point where FAR equals FRR. A lower CER means a more accurate system.
• Raising the threshold lowers FAR but raises FRR, and the reverse.

How It Works: The Four Modalities
Facial Recognition
• Process: capture, face detection, alignment, feature extraction, comparison with templates, match score.
• Uses: device unlock, airport boarding, law enforcement, photo tagging, retail analytics.
• Important distinctions:
  - Face detection finds that a face is present.
  - Face recognition identifies whose face it is.
  - Face analysis/characterization estimates age, gender or emotion. It is not identification but still raises privacy and bias concerns.
• Privacy risks: covert remote capture, mass surveillance, scraping of public images (e.g., the Clearview AI enforcement actions), demographic bias, function creep.
• Spoofing risks: photos, masks, deepfakes. Mitigated by liveness detection, such as 3D depth sensing and blink detection.

Speech / Voice Recognition
• Two different technologies:
  - Speech recognition works out what is said (speech-to-text). Example: virtual assistants.
  - Speaker recognition works out who is speaking (voiceprint). Example: bank call-center authentication.
• Speaker recognition can be text-dependent (a fixed passphrase) or text-independent (any speech).
• Privacy risks: always-listening devices, accidental activation, human review of recordings, inference of emotion or health, voice cloning and deepfake audio.
• Mitigations: wake-word processing on the device, clear indicators when recording, deletion options, liveness and anti-replay checks.

Fingerprint Recognition
• Process: a sensor (optical, capacitive, ultrasonic or thermal) captures ridge patterns. Minutiae such as ridge endings and bifurcations are extracted and matched.
• Uses: device unlock, time and attendance, border control, criminal records (AFIS).
• Generally well accepted and accurate, but it requires contact and cooperation, so covert collection is harder than with faces. Latent prints can still be lifted.
• Risks: centralized databases as breach targets (e.g., the US OPM breach exposed 5.6 million fingerprints), spoofing with gelatin or silicone molds, employee monitoring under BIPA.
• Best practice: store templates locally in secure hardware (e.g., a secure enclave) rather than on central servers.

DNA
• Process: a biological sample (saliva, blood, hair) is sequenced or profiled using markers such as STRs or SNPs.
• Uses: forensics, paternity testing, consumer genetics (ancestry, health), medical research.
• DNA is unlike other biometrics:
  - It is slow and not real-time, so it is not practical for everyday authentication.
  - It reveals health, ancestry and predisposition data.
  - It is shared with relatives, so one person's disclosure affects family members who never consented. Example: investigative genetic genealogy, as in the Golden State Killer case.
  - It is shed involuntarily everywhere.
  - It is very hard to truly anonymize.
• Related laws and incidents: GINA (US) limits genetic discrimination by insurers and employers. Various state genetic privacy laws apply. The 23andMe breach and bankruptcy raised concerns about genetic data sold as a business asset.

Privacy Risk Management Controls for Biometrics
• Data minimization: collect only what is needed and prefer verification (1:1) to identification (1:N).
• Local storage / on-device matching: keep templates on the user's device in secure hardware and avoid central databases.
• Template protection: use cancelable biometrics, biometric cryptosystems, encryption and hashing-like transforms so templates can be revoked and are unlinkable across systems.
• Consent and notice: get explicit, informed, often written consent (BIPA, GDPR Article 9) and offer non-biometric alternatives.
• Purpose limitation: prevent function creep, for example time-clock prints reused for surveillance.
• Retention schedules: delete data when the purpose ends (BIPA requires a public retention policy).
• Privacy Impact Assessment / DPIA: generally required for large-scale biometric processing under GDPR.
• Accuracy and bias testing: test across demographics (e.g., NIST FRVT) and keep human review for high-impact decisions.
• Liveness detection and anti-spoofing (presentation attack detection).
• Multi-factor authentication: treat a biometric as one factor (something you are) combined with something you know or have.
• Privacy by Design: embed protections from the start.

Comparison Snapshot
• Facial: passive and remote, highest surveillance risk, bias concerns, easy covert capture.
• Voice: remote and passive, separates speech-to-text from speaker ID, deepfake risk, ambient capture.
• Fingerprint: contact-based, mature and accurate, risk lies mainly in central databases and spoofing.
• DNA: most sensitive, familial implications, health inferences, slow, mostly forensic, medical and consumer genetics.

Exam Tips: Answering Questions on Biometrics: Facial, Speech, Fingerprint and DNA
1. Know verification vs. identification. Many questions hinge on 1:1 vs. 1:N. When asked for the most privacy-protective design, choose 1:1 verification with on-device templates.
2. Memorize FAR, FRR and CER. A low FAR means stronger security. A low FRR means better usability. A lower CER means a better overall system. For high-security settings, prioritize a low FAR. For convenience settings, tolerate a higher FAR.
3. Speech recognition vs. speaker recognition. Speech recognition is what was said. Speaker recognition is who said it, and only the latter is a biometric identifier.
4. Face detection vs. recognition vs. analysis. Detection alone does not identify. Watch for distractors that confuse these.
5. Remember irrevocability. If a question asks why biometrics are especially risky, the best answer is usually that they cannot be changed or reissued after compromise.
6. DNA's familial nature. When DNA appears, look for answers about relatives' privacy, health inferences and the difficulty of anonymization.
7. Prefer local storage and templates over raw data. Answers about storing raw images centrally are almost always wrong.
8. Associate the laws. BIPA means written consent, a retention policy, no sale and a private right of action. GDPR Article 9 means special category data, explicit consent or another Article 9 exception, plus a DPIA. CPRA means sensitive PI.
9. Think function creep and secondary use. Scenarios where data collected for one purpose (security) is reused for another (marketing, surveillance) point to purpose limitation as the answer.
10. Bias and accuracy. For facial recognition scenarios, choose answers involving demographic testing, human oversight and avoiding fully automated high-impact decisions.
11. Spoofing questions. The answer is typically liveness detection, presentation attack detection or multi-factor authentication.
12. Use the technologist lens. CIPT questions favor technical controls: encryption, on-device processing, cancelable templates, privacy by design and minimization. Choose these over purely policy answers when both are offered.
13. Read scenarios for collection context. Covert or passive collection (CCTV, smart speakers) points to transparency and notice issues. Cooperative collection (fingerprint enrollment) points to consent and retention issues.
14. Eliminate absolutes. Statements like 'biometrics are 100% accurate' or 'templates are anonymous data' are wrong.

Quick Recap
Biometrics are powerful and convenient, but they are permanent, uniquely identifying, often covertly collectible and rich in inferences. Control the risk by:
• minimizing collection and preferring 1:1 verification;
• storing protected templates locally;
• getting explicit consent and limiting purpose and retention;
• testing for accuracy and bias;
• defending against spoofing;
• conducting DPIAs.
Mastering these distinctions and controls will let you confidently answer scenario-based CIPT questions on facial, speech, fingerprint and DNA biometrics.