EU GDPR biometric compliance systems

April 2018 Editor's Choice, Access Control & Identity Management, Integrated Solutions

On May 25, 2018, enforcement of the new European Union General Data Protection Regulation (EU GDPR) begins. The regulation protects natural persons regarding the processing and the movement of their personal data. The regulation covers all forms of personal data (including even genetic, health and biometric data). Biometric data includes physical, physiological, and behavioural characteristics (Chapter I, Article 4).

The regulation provides examples of biometric data: facial images and dactyloscopic (fingerprint) data. The regulation recognises the need to have biometric data to identify uniquely natural persons. The regulation provides conditions for the protection of personal data, such as the consent of the natural persons (Chapter II, Article 9).

Biometric data is a special category

EU GDPR considers biometric data, when used for ID purposes, as a special category data that is more sensitive, requiring special protection.1 GDPR Article 4 defines biometric data as ‘physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic (fingerprint identification) data.’2 Processing of biometric data is prohibited by Article 9(1) of the GDPR, even with employee consent, unless a condition for processing special category data are listed in Article 9(2) applies.

Implementation of biometric data faces a further challenge because Article 9(4) allows EU member states to ‘introduce further conditions, including limitations to the processing of… biometric data…’3 GDPR applies to many companies, including American companies, that process personal data of EU citizens.4 Google is facing a lawsuit in an English court where two anonymous litigants want search results to their old legal convictions ‘forgotten’.5 Publicity surrounding the lawsuit has led 650 000 ‘Right To Be Forgotten’ requests to Google.6 These should be a wakeup call to all companies. As late as February 2018, Jason Rosen of Gigya, an Israel-based SAP Company, has opined that: “There is no product on the market that can make your organisation GDPR compliant.”7

Penalties for non-compliance

While the new regulation is vague and untested, the penalties for non-compliance are not vague. The regulation applies to all organisations collecting or processing personal data of persons in the European Union – regardless of where the organisations are headquartered in the world. Penalties for non-compliance can be as high as 20 million Euros, or 4% of total worldwide turnover (sales) of the preceding year, whichever is higher (Article 83). There can be repeated penalties for different years or for difference instances.

GDPR-compliant systems

Many software companies have responded by announcing their offerings of GDPR-compliant systems. The typical system involves a suite of tools. For example, the regulation includes notification and consent requirements. Many companies will respond to the regulation by designating a data protection officer (DPO). Auditors will be needed to audit the usage of personal data, consent (including withdrawal of consent) practices, and of data privacy notices.

While some of the software companies have acknowledged the existence of biometric data in the regulation, there has been little detailed explanation of how their systems will deal with biometric data. Some software companies might not have any biometric systems to include within their suite. Other software companies rely upon partnerships with biometric software companies to provide a complete GDPR-compliant system.

The Google case relating to the right to consent to data processing and to the right to withdraw consent (or right to be forgotten) is an example of future cases to follow with GDPR enforcement.

Biometric compliance systems

This is a review of some of the software companies offering GDPR-compliant systems with a focus upon whether their suites of software tools include biometric software.

SAP ERP – employee focus

SAP’s current GDPR postings provide details of its SAP SuccessFactors HCM Suite. SAP noted that GDPR compliance would need to include personal data on employees and on potential employees being recruited. For employees, SAP’s system would include: personal details, bank data, human resources data, qualifications and educational details, salary and social security data, system access, system usage, and authorisations. This suite would be deployed in the SAP cloud. All data will be encrypted at rest and during transmission.

Even though employees of companies are supplying personal information to their employers, there remain questions about the consent of employees as to which persons at the employer’s company or at other companies should be able to read and to use the individual personal data. Encryption and passwords are not enough. Companies will need biometric systems to be able to prove exactly who accessed and processed the personal data of employees.

A GDPR-compliant system would need to include extensive solutions for the data of individual customers. Companies may have millions of customers in the EU and online internationally.

SAP ERP has not included in its white papers the names or the details of its approved biometric system partners: valantic bioLock and Fujitsu.

Valantic bioLock

Formerly known as realtime, valantic has SAP Gold Partner status. For decades, SAP has used independent partners to provide third-party solutions. In addition to the use of fingerprints, bioLock now provides a platform for Fujitsu’s PalmSecure hand vein technology. You may find detailed explanations of biometric compliance with GDPR at http://www.palmsecurebiolock.com

Fujitsu’s PalmSecure is proprietary technology using unpublished algorithms and sub-surface biometric characteristics. EU GDPR provided examples only of superficial biometric characteristics: fingerprints and facial scans.

Fujitsu

In addition to biometrics, Fujitsu offers guidance on data infrastructure.

Oracle

Oracle has recommended that GDPR compliance will require the co-ordination of many of an organisation’s entities, such as: legal, human resources, marketing, security, and IT. You will need to look in many places to find personal data, such as: databases, unstructured data, files, MAC or IP addresses, and metadata. There will be a need to improve security controls. Oracle provides ‘always on’ encryption via on-chip hardware encryption in the CPU (part of Oracle’s SPARC processors).

While Oracle has a Biometric Authentication Service, Oracle did not mention this service in its explanations of GDPR compliance.

SuperOffice – customer focus

In contrast to SAP’s focus on employees, SuperOffice stressed the importance of complying with marketing activities. Companies may have far more customers than they have employees. Marketing campaigns can include emails, telephone calls, and visits. Some companies use refer-a-friend campaigns. With GDPR, the issue becomes which personal information did you store or process in your system. One of the examples provided by SuperOffice was the 2014 fine levied against Flybe because Flybe had emailed 3,3 million persons who had opted out of marketing promotions with the email: ‘Are your details correct?’

Conclusions

To make matters worse, member states of the European Union will develop detailed laws and penalties consistent with EU GDPR. The explicit recognition of biometric data in the regulation suggests that an important way to increase the protection of personal data is to make more use of biometric systems. While some software companies have responded by offering suites of tools for GDPR compliance, the details of the suites have related to employees or to customers. Biometric tools are critical for the protection, storage, and processing of unique individual data. In evaluating your options for making your system GDPR-compliant, you need to insist that software companies explain the quality of biometric tools beings offered in their suites.

On March 19, 2018, shares of Facebook and of the stock markets tumbled after investors realised that other countries might adopt similar draconian regulations. These regulations could include requiring companies in many countries to require that customers opt into approving the selling or sharing of the personal data of customers. This would have a huge impact on the profitability of many companies.

Sumantra Chakravarty.
Sumantra Chakravarty.

Paul Sheldon Foote.
Paul Sheldon Foote.

References

1. “Special category data,” UK Information Commissioner’s Office, https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdplaful-basis-for-processing/special-category-data/

2. “Using Biometric data? Sensitive under GDPR!” Jorden Baily and Matthijs van Bergen, Legal ICT, October 18, 2017, https://legalict.com/2017/10/18/using-biometric-data-sensitive-under-the-gdpr/

3. “Processing of special categories of personal data,” Art. 9 GDPR, https://gdpr-info.eu/art-9-gdpr/

4. “How the GDPR Will Change the World,” Jan Phillip Albrecht, European Law Protection Review, 2(3) 2016, https://edpl.lexxion.eu/article/edpl/2016/3/4

5. “Google Faces England’s First ‘Right To Be Forgotten’ Trial,” Kaye Wiggins, Stephanie Bodoni and Jeremy Hodges, Bloomberg Technology, January 2018, https://www.bloomberg.com/news/articles/2018-01-18/google-braced-for-england-s-first-right-to-be-forgotten-trial

6. “Google has Received 650,000 ‘Right To Be Forgotten’ Requests since 2014,” James Doubek, National Public Radio, February 2018, https://www.npr.org/sections/thetwo-way/2018/02/28/589411543/google-received-650-000-right-to-be-forgotten-requests-since-2014

7. “Three GDPR Myths that Could Cost Your Organization Millions” Jason Rose, Gigya – an SAP Company, https://www.forbes.com/sites/sap/2018/02/22/3-gdpr-myths-that-could-cost-your-organization-millions/#490a796a7504

Resources (Whitepapers and other GDPR content)

• European Union General Data Protection Regulation: https://www.eugdpr.org/

• Fujitsu: http://www.fujitsu.com/fts/solutions/business-technology/security/gdpr/

• Microsoft GDPR: https://www.microsoft.com/en-us/TrustCenter/Privacy/gdpr/readiness

• Oracle: https://www.oracle.com/uk/corporate/features/gdpr.html

https://docs.oracle.com/cd/A57673_01/DOC/net/doc/NWANO233/ch8.htm

• SAP ERP: https://www.successfactors.com/en_us/lp/gdpr-compliance.html

https://discover.sap.com/gdpr/en_us/index.html

• SuperOffice: https://www.superoffice.com/blog/gdpr-marketing/valanatic bioLock: http://www.palmsecurebiolock.com/

For more information, contact Professor Paul Sheldon Foote, California State University, Fullerton, [email protected]





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Biometric security key for phishing-resistant MFA
Products & Solutions Access Control & Identity Management
New FIDO-compliant USB, Bluetooth, and NFC BioKeys with biometric login and centralised management for phishing-resistant, passwordless multifactor authentication (MFA) for enterprise users.

Read more...
Winners of the 2025 Southern Africa OSPAs
Editor's Choice
The winners of the 2025 Southern Africa Outstanding Security Performance Awards (OSPAs) were revealed on Wednesday, 4th June, at Securex South Africa. Winners from all categories (except the Lifetime Achievement) will be featured in the second Global OSPAs set to take place in 2026.

Read more...
Gallagher Security releases OneLink
Gallagher Animal Management Products & Solutions Access Control & Identity Management
Gallagher Security has announced OneLink, a cloud-based solution that makes it faster, easier and more cost-effective to deploy security anywhere in the world, transforming how security can be delivered to remote sites and distributed infrastructure.

Read more...
Deepfakes and digital trust
Editor's Choice
By securing the video right from the specific camera that captured it, there is no need to prove the chain of custody for the video, you can verify the authenticity at every step.

Read more...
A new generational framework
Editor's Choice Training & Education
Beyond Generation X, and Millennials, Dr Chris Blair discusses the seven decades of technological evolution and the generations they defined, from the 1960’s Mainframe Cohort, to the 2020’s AI Navigators.

Read more...
Suprema unveils BioStar Air
Suprema neaMetrics News & Events Access Control & Identity Management Infrastructure
Suprema launches BioStar Air, the first cloud-based access control platform designed to natively support biometric authentication and feature true zero-on-premise architecture. BioStar Air simplifies deployment and scales effortlessly to secure SMBs, multi-branch companies, and mixed-use buildings.

Read more...
Back-up securely and restore in seconds
Betatrac Telematic Solutions Editor's Choice Information Security Infrastructure
Betatrac has a solution that enables companies to back-up up to 8 TB of data onto a device and restore it in 30 seconds in an emergency, called Rapid Access Data Recovery (RADR).

Read more...
Key design considerations for a control room
Leaderware Editor's Choice Surveillance Training & Education
If you are designing or upgrading a control room, or even reviewing or auditing an existing control room, there are a number of design factors that one would need to consider.

Read more...
Smart cities and the role of video security
Surveillance Integrated Solutions
As cities around the world continue to embrace smart technology, including IoT that not only connects to people, but also the surrounding activity, the integration of advanced video security systems is crucial to ensure safety and efficiency in environments.

Read more...
The benefits of offsite control rooms
Astrosec Surveillance Integrated Solutions
As the security landscape grows more intricate, control rooms – the crucial hub of security operations – need to adapt. With escalating costs, mounting threats, and a heightened demand for immediate responses, many organisations are reassessing the operations of their control rooms.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.