Biometric privacy and regulations: Is this the last human rights frontier?

• Author:
• Author name

  Quantumrun Foresight
• July 19, 2022

Insight summary

The increasing reliance on biometrics for access and transactions underscores the necessity for stringent regulations, as misuse could lead to identity theft and fraud. Existing laws aim to protect this sensitive data, driving businesses to adopt strong security measures and fostering a shift toward privacy-conscious services. This dynamic landscape can also prompt the emergence of data-intensive industries, impacting cybersecurity, consumer preferences, and government policymaking.

Biometric privacy and regulations context

Biometric data is any information that can identify an individual. Fingerprints, retinal scans, facial recognition, typing cadence, voice patterns, signatures, DNA scans, and even behavioral patterns such as web search histories are all examples of biometric data. The information is often used for security purposes, as it is challenging to fake or spoof because of each individual’s unique genetic patterns.

Biometrics has become common for crucial transactions, such as accessing information, buildings, and financial activities. As a result, biometric data needs to be regulated as it is sensitive information that can be used to track and spy on individuals. If biometric data falls into the wrong hands, it could be used for identity theft, fraud, blackmail, or other malicious activities.

There are a variety of laws that protect biometric data, including the European Union’s General Data Protection Regulation (GDPR), Illinois’ Biometric Information Privacy Act (BIPA), California Consumer Privacy Act (CCPA), the Oregon Consumer Information Protection Act (OCIPA), and the New York Stop Hacks and Improve Electronic Data Security Act (SHIELD Act). These laws have different requirements, but they all aim to protect biometric data from unauthorized access and use by forcing companies to ask for consumer consent and informing consumers of how their information is being used.

Some of these regulations go beyond biometrics and cover Internet and other online information, including browsing, search history, and interaction with websites, applications, or advertisements.

Disruptive impact

Businesses may need to prioritize robust protection measures for biometric data. This entails implementing security protocols such as encryption, password protection, and restricting access to authorized personnel only. Additionally, companies can streamline compliance with data privacy laws by adopting best practices. These measures include clearly describing all areas where biometric data is collected or used, identifying the necessary notifications, and establishing transparent policies governing data collection, usage, and retention. Regular updates to these policies and cautious handling of release agreements may also be required to ensure they don't limit essential services or employment on biometric data release.

However, challenges persist in achieving strict data privacy compliance across industries. Notably, the fitness and wearables sector frequently collects vast amounts of health-related data, including everything from step counts to geolocation tracking and heart rate monitoring. Such data is often leveraged for targeted advertising and product sales, raising concerns about user consent and data usage transparency.

Furthermore, home diagnostics pose a complex privacy challenge. Companies often obtain permission from customers to use their personal health information for research purposes, granting them significant freedom in how they utilize this data. Notably, companies like 23andMe, which provide ancestry mapping based on DNA, have harnessed these valuable insights, earning substantial income by selling information related to behavior, health, and genetics to pharmaceutical and biotech companies.

Implications of biometric privacy and regulations

Wider implications of biometric privacy and regulations may include: 

• An increased proliferation of laws that provide comprehensive guidelines for the capture, storage, and utilization of biometric data, especially in public services like transportation, mass surveillance, and law enforcement.


• Heightened scrutiny and penalties imposed on major tech corporations for unauthorized data utilization, contributing to improved data protection practices and consumer trust.


• Greater accountability within sectors that gather substantial daily data volumes, requiring regular reporting on data storage and usage procedures to ensure transparency.


• The emergence of more data-intensive industries, such as biotechnology and genetic services, demanding an increased collection of biometric information for their operations.


• Evolving business models with a shift towards providing secure and privacy-conscious biometric services to cater to a more informed and cautious consumer base.


• A reevaluation of consumer preferences, as individuals become more discerning about sharing their biometric information, leading to a demand for enhanced transparency and control over personal data.


• A potential economic boost in the cybersecurity sector as businesses invest in advanced technologies and expertise to safeguard biometric data.


• A growing influence of biometric data on political decisions and policymaking, as governments harness this information for purposes such as identity verification, border control, and public safety.


• The need for ongoing research and development in biometric technology, spurring advancements that enhance security and convenience, while concurrently addressing ethical and privacy concerns.

Questions to consider

• What are the products and services that you consume that require your biometrics?


• How do you protect your biometric information online?