Protocols and Tools
Protocols and Tools
The concern over the collection, storage, and use of biometric data can be expected to increase exponentially with the
expanded use of the technologies due to the individual privacy issue and the related legal requirements. To address this
concern NBSP has developed a guideline for the collection, use, dissemination and storage of biometric data. While this
guideline is developed in the form of an NBSP policy document, it is intended to be used as an example for development
of similar internal policy documents by any organization, in both the public and private sectors, that may have a
compliance requirement under the federal laws referenced therein.
A Protocol for the Collection, Use, Dissemination, and Storage of Biometric Data
The purpose of this biometric data protocol may be summarized as a formal guideline for employees and contractors to
adhere to regarding the handling of biometric information. It is intended to define a policy and requirements for
compliance with laws and regulations which are deemed to apply to this area.
For purpose of the protocol, biometric data or information is divided into the following categories:
Category I: General data or information that is considered in the public domain and is related to
biometric technology, sources, performance, testing, characteristics, and development programs in the public or
private sector, but does not include actual biometric templates in any form, or the personal data of any individual
directly or indirectly related to such templates.
Category II: Data that is sequestered or restricted for any reason (other than Category III data)
and not in the public domain. This could include, but is not limited to, data which is classified; handled as FOUO
(for official use only); describes vulnerabilities of technology or countermeasures to threats against the technology;
is proprietary to any organization or person; or consists of non-publicized test results, non-public technology or
product performance evaluations.
Category III: This includes all data related to a person, specifically including medical, financial,
educational, and personal or family history not in the public domain. It also includes biometric templates (otherwise
described as the biometric code) developed, assembled, or constructed from the live image or characteristic of any
individual, and acquired with or without the formal consent of that individual.
Handling of personal (Category III) information by the government raises the sensitive issues of individual privacy and there
are numerous laws and regulations that are or may be applicable.
For present purposes it will suffice to recognize that these laws and regulations rest on four fairness concerns - notice,
choice, access, and saf eguards.1 Notice should allow people to know what personal information is being
taken by the government, how it is being used, and with whom it might be shared. Choice should allow people to decide
whether to give the information, to what extent it will be used, and to whom it will be given. Access should allow people
to know what information the government has about them and allow them to correct it if it is wrong. Finally, the safeguarding
of this information should be sufficient so as to meet a reasonable standard for data security. This protocol addresses each
step of the biometric information database life cycle.2
1 Federal Trade Commission, "Privacy Online: Fair Information Practices in the Electronic Marketplace,"
May 2000, p. iii.
2 An information life cycle is the stages through which information passes. This typically is creation or
collection, processing, dissemination, use, storage, and disposition. Office of Management and Budget (OMB) Circular A-130,
"Management of Federal Information Resources," p. 3.
