Economic Cooperation and Development Guidelines

Solution Preview

BIOMETRICS, USE OF BIOMETRIC IN PRIVATE SECTOR, THE BEST PRACTICES FOR PRIVACY-SYMPATHETIC BIOMETRIC DEPLOYMENT & THE ORGANISATION FOR ECONOMIC CO-OPERATION AND DEVELOPMENT (OECD) PRIVACY PRINCIPLES:

A person's unique traits are measured and analyzed by using Biometrics. Private sectors uses biometrics where the applications are numerous routinely controlling access to everything from computers and computer accounts, banks and financial records to office and residential buildings, sports venues and theme parks.

BIOMETRICS USE IN THE PRIVATE SECTOR

The applications of biometrics in the private sector is exponentially growing, it is not only used to protect personal property and financial transactions but even major and minor companies are routinely using this technology to ensure employee integrity. Following are some of the places where biometrics involving a multi-factor authentication method is used to control access:
• Personal computers
• ATM machines
• Residential
• Office complexes
• Every mode of transportation to include luxury automobiles, aircraft and boats.

Biometric in Business:
In businesses biometric involving fingerprinting employees has lead to the following benefits:
• Pinpointing the employee responsible for any error.
• Increase in sales.
• Reduction in both unauthorized transactions and payroll fraud.
• Increase in employee attendance: The previously used employee time card clock-in method allowed anyone to "punch" the timecard of a co-worker. This resulted in employee taking unnecessary leave and yet getting paid for the work time shown in the time clock. Such incidents would lead to drop in productivity of the business. Biometric technology now uses positive identification of an employee via the requirement to be physically present and scan their fingerprint to establish actual work attendance.

Biometric in financial institutions:
In countries like Japan ATM machines uses fingerprinting as part of the biometric technology used in these machines. ATM card users along with their ATM card PIN and the card have to also place their fingers in a scanner, which makes a positive identification of the person before dispensing money. An infrared light in these fingerprint scanners detect a unique pattern of micro-veins beneath the surface of the finger. This is then matched with a pre-registered profile to verify an individual's identity.

Biometrics in recreational entertainment and sports industries:
Biometrics technology and its use are now commonplace in the recreational entertainment and sports industries.
• Recreational entertainment companies: Walt Disney and SeaWorld parks use biometric technology where original purchaser of the ticket is fingerprinted while buying the passes. This ensures that the original purchaser does not, without proper authorization, transfer use of the same pass to multiple users. Use of this type of biometric at these theme parks have enforced people to buy their own pass and as a result effectively increased park revenue and decreasing fraudulent pass use.
• Sports venue management includes stadium and arena security, with large venues often incorporating biometrics technology in the ticketing and entrance processes. Not only does this serve to control fraudulent ticket and pass sales but also assists law enforcement in identifying and controlling potential problems through the identification of known or suspected criminals and terrorists.

BEST PRACTICES FOR PRIVACY-SYMPATHETIC BIOMETRIC DEPLOYMENT
There are guidelines known as "Best Practices" to be followed by every private sector while applying biometric practices. These best practices ensure that privacy of the personal whose biometric data is being used is properly preserved and secured. These Best Practices are meant to address the full breadth of biometric applications and technologies, from small-scale physical access to nationwide identification programs.

The categories of Best Practices are (1) Scope and Capabilities, (2) Data Protection, (3) User Control of Personal Data, and (4) Disclosure, Auditing, Accountability, Oversight.

SCOPE AND CAPABILITIES:
Scope Limitation:
Any expansion of biometric deployments should not be done in order to perform a more comprehensive verification of an individual than what was originally intended. Any expansion or retraction of scope should be accompanied by full and public disclosure, under the oversight of an independent auditing body, allowing individuals to opt-out of system usage if possible.

Establishment of a Universal Unique Identifier:
There should be adequate protection in any private sector to prevent to the degree possible, biometric information from being used as a universal ...