Data protection issues in biometric databases

Introduction

Biometric databases contain personal information obtained from an individual's unique physical or behavioural characteristics. These characteristics include fingerprints, facial images, iris patterns, voice recordings, DNA profiles and other biological identifiers. Governments, healthcare institutions, banks, educational organisations and private companies use biometric databases for identity verification, security, authentication and research purposes.

Although biometric technology improves identification and service delivery, it creates serious privacy and data protection concerns. Unlike passwords, biometric characteristics cannot easily be changed when compromised. Unauthorised access, excessive collection, profiling and misuse of biometric information may permanently affect an individual's privacy and personal security.

Therefore, biometric databases require strong legal safeguards, transparent collection procedures, restricted access and effective cybersecurity measures.

Legal framework in India

1. Digital personal data protection act, 2023

The Digital Personal Data Protection Act, 2023, establishes India's framework for processing digital personal data.

Section 4 establishes requirements for lawful processing of personal data. Section 6 addresses consent, while Section 8 specifies obligations of data fiduciaries concerning compliance and security safeguards.

Biometric information qualifies as personal data when it relates to an identifiable individual. However, the Act does not create a separate statutory category of sensitive personal data specifically for biometrics.

Organisations collecting fingerprints, facial images or iris information must therefore ensure that applicable processing requirements are satisfied.

2. Information technology act, 2000

The Information Technology Act, 2000, provides protection against certain forms of unauthorised access, misuse and disclosure of electronic information.

Important provisions include:

Section 43: Addresses unauthorised access and damage to computer systems.

Section 66: Covers specified computer-related offences.

Section 70: Provides for protected computer systems.

Section 72: Addresses breach of confidentiality and privacy by persons obtaining access through powers conferred under the Act.

These provisions may become relevant when biometric databases are accessed or manipulated without authorisation.

3. Aadhaar act, 2016

The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, regulates the Aadhaar identification system.

Section 29 restricts the use and disclosure of core biometric information and establishes protections concerning identity information.

Section 30 recognises biometric information as sensitive personal information for the purposes of the Aadhaar framework.

The Act also establishes restrictions on sharing and accessing Aadhaar-related information.

4. Information technology rules, 2011

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, included biometric information within the category of sensitive personal data or information.

These rules established requirements concerning consent, purpose limitation, security practices and disclosure. Their present application must be assessed alongside subsequent amendments and the DPDP framework.

Major data protection issues

1. Unauthorised collection

Organisations may collect fingerprints, facial images or voice recordings without adequately explaining the purpose.

Such practices can undermine individual autonomy and create privacy risks.

2. Biometric data breaches

Biometric databases are attractive targets for cybercriminals because they contain permanent identification characteristics.

Unlike ordinary passwords, compromised fingerprints or iris patterns cannot simply be replaced.

3. Surveillance and profiling

Governments and private organisations may use facial recognition and biometric identification systems to monitor individuals.

Excessive surveillance can interfere with privacy, freedom of movement and other constitutional rights.

4. Accuracy and discrimination

Biometric systems may produce inaccurate identification results because of technical limitations or differences in system performance across demographic groups.

Incorrect identification can result in denial of services, financial losses or unfair treatment.

5. Third-party sharing

Biometric information may be transferred between government departments, financial institutions and technology providers. Such sharing creates risks of unauthorised access and misuse.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 of the Constitution.

The judgment recognised informational privacy and established that restrictions on privacy must satisfy constitutional requirements, including legality, legitimate purpose and proportionality.

Relevance: Collection and processing of fingerprints, facial images and other biometric information must respect individual privacy. Organisations should ensure that biometric processing has a lawful basis and appropriate safeguards.

2. K.S. Puttaswamy v. Union of India (Aadhaar case, 2018)

The Supreme Court examined the constitutional validity of the Aadhaar framework and considered the collection, storage and use of biometric and identity information.

The Court upheld the Aadhaar framework subject to important limitations and safeguards, while restricting certain forms of private-sector use and mandatory linking.

Relevance: This judgment is directly important to biometric database governance in India. It establishes that biometric identification systems must operate within constitutional limits and appropriate statutory safeguards.

3. District Registrar and Collector v. Canara Bank (2005)

The Supreme Court examined privacy concerns involving access to private documents and recognised the importance of protecting confidential information.

Relevance: The judgment supports the principle that access to personal records must be legally justified. Biometric database operators should similarly prevent unnecessary access and disclosure.

4. S and Marper v. United Kingdom (2008)

The European Court of Human Rights examined the retention of fingerprints and DNA profiles of individuals who had not been convicted of criminal offences.

The Court held that indiscriminate retention violated Article 8 of the European Convention on Human Rights.

Relevance: The judgment demonstrates that retaining biometric information without sufficient justification may violate privacy rights. Biometric databases should therefore follow appropriate retention and deletion policies.

Data protection and compliance measures

Organisations managing biometric databases should adopt strong technical and administrative safeguards.

Important measures include:

Obtain valid consent or establish another applicable lawful basis.

Collect only biometric information necessary for the specified purpose.

Encrypt biometric records during storage and transmission.

Implement multi-factor authentication and restricted access.

Maintain audit trails of access and data modifications.

Establish retention and secure deletion policies.

Conduct regular cybersecurity assessments.

Review third-party sharing arrangements.

Test biometric systems for accuracy and discriminatory outcomes.

Establish procedures for reporting and responding to data breaches.

Conclusion

Data protection in biometric databases is essential for safeguarding privacy, identity security and individual autonomy. In India, the Digital Personal Data Protection Act, 2023, Aadhaar Act, 2016, and Information Technology Act, 2000, provide important legal safeguards. Judicial decisions such as Puttaswamy, District Registrar and Collector v. Canara Bank and S and Marper v. United Kingdom establish significant principles concerning privacy, proportionality and the protection of personal information. Organisations must therefore ensure lawful collection, limited use, secure storage and responsible retention of biometric information to prevent misuse and maintain public trust.