Marie Shroff: Be wary of how they put the finger on us

COMMENT

Biometrics - what are they and why are they becoming a hot topic?

We tend to think of biometrics as being a recent technological marvel - iris scanning, facial recognition, fingerprint access - as seen on movies such as Tom Cruise's Minority Report and now in real life.

But biometric technologies are possibly the oldest method of establishing identity. Fingerprints were used in Babylon as seals on clay tablets recording business deals.

Part of the appeal of biometric identification technologies is that they are tools we use instinctively from the day we are born. Babies from early on can distinguish their mothers' faces and voices.

We recognise friends at a distance by the way they move as well as their shape. Our first writing is usually our own name. These characteristics are an intimate part of our identity as individuals.

But biometrics is undergoing rapid and far-reaching developments, with big potential implications for how personal information is handled. Biometric measurement of faces, voices, signatures, gait and shapes are all in use today. The capacity for use or abuse of this to generate a sense of fear, invasion or loss is obvious.

Not long ago I attended the 26th International Conference on Privacy and Personal Data Protection in Poland, attended by nearly 1000 government and business representatives. Biometric identification was one of the key sessions.

Privacy issues raised by the use of biometrics included: monitoring from afar through facial recognition technology; movement tracking by electronic means; loss of anonymity in public spaces with video surveillance; the use of DNA beyond the purpose for its original collection; and use by both the private and public sector, encouraged by decreasing technology costs.

The link between ethics and science - for that is where biometrics sits - is a potent, provocative combination. Developments in nuclear science, human-assisted reproduction, genetically modified organisms and human genetic engineering have all led to fierce social and political debate.

Biometric technology will not slip by without catching the attention of some political parties and the public. How prepared are we to debate the pros and cons? What reassurance could we offer to the public?

Where are the limits of the technology now and in the future? How can we reap the benefits of this technology without alienating the public and infringing their rights?

For example, ID theft is reported to be increasing all over the world and articles lately suggest it is becoming increasingly targeted by organised crime. Biometric identification may help to protect us from that but, conversely, if those technologies can be perverted to the use of crime, the results would be frightening.

So where does privacy fit in all this? Privacy is, of course, ultimately about individuals. Individuals are the building blocks of society. Each of us needs freely to form, develop and maintain our identity and sense of self; we need a personal safety zone to provide that freedom.

New Zealand, fortunately, has good basic protections in place. The principles in the Privacy Act involve a few key components - openness, fairness, and clarity of purpose. A good regime for collection and use of biometric information must have these characteristics.

Concerns about the safety and use of individual information are increasing, and increasingly justified. On the other hand, these exciting technology developments are a major tool for government and business to improve efficiency, service and security. Experience has shown that the Privacy Act can cope with most of these developments.

And we certainly need those protections. At no time have we had more pressure to use privacy-invasive technology, the capacity to do so and interest, as well as fear and concern, from the public.

Like many other countries with visa-waiver status for travel to the United States, New Zealand needs to incorporate a facial biometric identifier into each newly-issued passport from next October by way of a digitised photo on a microchip. New Zealand Customs is also testing facial recognition software.

These are examples of high-level systems with rigorous testing, but there are also smaller-scale New Zealand examples, such as the school that introduced student fingerprints rather than library cards for the issue of library books.

We will have to confront these issues. Decisions and priorities will all but be determined for us unless we move forward.

We have some key guiding pointers. The first is that there is huge power for good, and huge power for misuse. We need controls and protections.

The second is that taking privacy into account is good for business. Fair dealing and openness are good business fundamentals. People will choose with their feet and a business or government that plays fast and loose with their personal information will not flourish.

Thirdly, citizens have real rights. The Privacy Act is not special; it is part of a wide range of consumer and human rights protections that make New Zealand a good place to live.

A specific function under the Privacy Act is the power to make codes of practice. The Australians are considering a code for biometrics. I do not suggest a code is necessarily the best or only solution. But if the industry does not act to self-regulate, it is likely the Government or the Privacy Commissioner will step in and do so.

In New Zealand we will give almost anything a go. This is good as long as we proceed with caution and are wary of snake-oil salesmen. We can find a proportionate response in which there is a culture of respect for privacy as well as an appetite for the new. Biometrics is a technology whose time has come.

The technology itself is neutral, but its application may not be. The choice is in our hands: there is the possibility of both privacy-invasive or privacy-enhancing implementation and use.

* Marie Shroff was talking to a conference of the Biometrics Institute held in Wellington.