EXPERT RESPONSE
Your first hunch is absolutely correct. Biometric data is still personal information and, as a result, should be treated with the utmost privacy and protected just like any employee data should be. Biometric data is unique and, in some circumstances, its unauthorized release can harm your employees.
But your HR and IT departments may have overlooked that fact since biometrics data doesn't look, act or feel like other personal information. Before allowing user access to a system, the various elements captured by a biometrics system -- fingerprints, voice prints, iris patterns or facial features -- all have to be converted to digital data that can be read by authentication hardware and software. Such digital data is often stored in directories like Active Directory, holding authentication profiles of users that are invisible and inaccessible to HR and IT staff.
Biometrics aren't foolproof though. If the digital data representing a biometric profile is stolen, or sniffed off an insecure network, it can sometimes be copied and reused, similar to how a stolen user ID and password is used. Malicious hackers can then gain access to the system.
On the other hand, biometric data is considered an authentication credential, like a user ID and password, and may not legally be considered personal information equivalent to a Social Security number or account number. You may want to consult your legal or compliance departments to get a precise read on pertinent legislation, like the Sarbanes-Oxley Act (SOX) or the Gramm-Leach-Bliley Act (GLBA), that affects employee records.
More information:
Get a glimpse of where biometric authentication is headed.
Learn which policies and standards can protect personal data.
|
