Technology in Focus | As biometrics use become widespread ... Experts call for fast-tracking of data protection law

The collection of biometric data via fingerprints is becoming more prevalent in Jamaica. Some businesses require employees to use biometric devices to clock in, and the technology is also widely used on smartphones.

However, information technology experts are cautioning users to be more conscious when giving permission for their biometrics to be taken as the possibility exists that the security of the data could be compromised.

Jamaica Computer Society President Dr Sean Thorpe says there is an urgent need for the Data Protection Bill to be finalised to safeguard the privacy of individuals; set guidelines for how personal data can be collected, processed and stored; and how such data can be used or disclosed.

“Legislation needs to be put in place to support the global acceptance of biometric collection of data by companies. A lot of these issues will not be resolved unless the legislation is passed. It needs to happen sooner than later,” said Thorpe, who is head of the School of Computing and Information Technology at the University of Technology, Jamaica.

SECURITY BREACHES

“Although the argument is that digital fingerprinting has a high level of accuracy, because of the computing algorithm, it does not contend that the security breach for that environment is possible. For us, it is really a grey area without the legislation being available to support it,” he said.

In agreement, technical services manager at Contax 360 BPO Solutions and former ICT lecturer at the Northern Caribbean University, Henry Osborne, stated that there is a general mistrust or concern about how the data might be used.

“You would want to ensure that whichever organisation is collecting your data has strong data-security practices, and this can be ensured if we have a strong Data Protection Act, which will force companies to ensure that the data is secured,” he said, adding that the legislation would also give persons more control over their personal data.

“A lot of companies are collecting our data, and we don’t know what is happening to it. A data protection legislation will give us more control over what happens to our data,” Osborne posits.

The Data Protection Bill is now before a joint select committee of Parliament.

In July, Technology Minister Fayval Williams said that the Data Protection Bill is a significant piece of legislation that sets clear guidelines for how the Government, businesses and organisations should correctly collect, store and dispose of persons’ personal and sensitive data.

Williams noted that under the protection regime, data subjects will have new rights.

“We will have a right to know what data is being collected about us. We will have the right to know who has access to that data and for what reason, because data about all of us forms part of our digital identity,” she said.

... How the collection of biometrics is done

Explaining how the collection of biometrics is done, as it relates to fingerprints, business analyst – project management at MC Systems, Toussaint Stewart, stated that biometrics is the science of analysing an individual’s physical or behavioural characteristics to be able to authenticate their identity.

“Identifying an individual via fingerprinting is said to be one of the most reliable methods, as biologically, your fingerprint does not change on its own. Fingerprints can only be changed due to external/environmental conditions,” he informed.

Stewart noted that in identifying an individual via fingerprinting, the ridges/lines on the first joint of the individual’s fingers which forms a unique pattern are captured and stored on a database for future reference.

“This pattern will require additional information being affixed to it, such as name, date of birth and a photograph, in order to determine who a fingerprint belongs to. Once this profile is created, this individual can now be verified/identified to be who they say they are via means of capturing their fingerprint and comparing it with fingerprints that are on the same database on which the profile exists,” he added.

Stewart said that when a person is travelling, airports are able to identify them based on their travel records by scanning their fingers and having the pattern checked on their database.

... Biometrics for mobile devices and law enforcement

Turning to the use of fingerprints to access mobile devices, Stewart stated that there is the option of placing a specific finger on the scan area for the pattern of that finger to be captured and stored on a database and can then be used to unlock the device.

The technology can also be used as a means of authorisation of a purchase via a mobile device, he added. Upon setting up their profile, the individual is prompted to scan their finger when making a purchase and the pattern cross-referenced with the database to authorise the sale.

“Now, as it relates to a crime, law-enforcement departments have profiles of persons, which includes their fingerprint. Therefore, if an unidentified individual commits a crime and their fingerprint is retrieved at the crime scene, that fingerprint can be compared against fingerprints on a database to identify who the individual is upon getting a match,” Stewart said.

Send feedback on this article to solutions@mcsystems.com.