Real-Life Biometric Data Breaches
1. US Customs and Border Protection (CBP)
In 2019, US CBP announced that it had suffered a data breach that resulted in the compromise of over 100,000 traveler photos. The photos were stolen from a vendor that had been hired to license facial recognition software to the CBP. Hackers were able to access the photos and sell them on the dark web, potentially exposing the travelers to identity theft, fraud, and other malicious activities.
2. Aadhaar Data Breach
In 2018, a security researcher discovered a flaw in India’s Aadhaar biometric database, which contained the personal information of over 1.1 billion Indians. The vulnerability allowed anyone with access to the database to download and extract information, including names, addresses, phone numbers, and even biometric data. The data was being sold on WhatsApp for as low as $8, further endangering individuals’ privacy.
3. OPM Data Breach
In 2015, the Office of Personnel Management (OPM) suffered a data breach that resulted in the theft of personal information of over 22 million individuals. Among the data stolen were fingerprint records of over 5 million individuals, which were of particular concern since fingerprints are unchangeable data. The loss of such information puts individuals at heightened risk of identity theft and other fraudulent activities.
Why Biometric Data Disposal is Important
When it comes to disposing of any sensitive data, including biometric data, it is important to understand why data disposal is critical. Here are some reasons why the proper disposal of biometric data is crucial:
1. Protects Personal Identity
Biometric data is permanent and therefore unique. Even if other types of data are compromised, they can be changed to prevent further damage. In the case of biometric data, it is impossible to change or revoke them. This makes it essential to protect dy biometric data since a breach may compromise an individual’s entire identity.
2. Compliance with Regulations
Several countries have regulations that protect the personal information of their citizens. For instance, The General Data Protection Regulation (GDPR), which is harmonized to apply in all EU countries, requires organizations to keep biometric data confidential and secure it when disposing. Additionally, firms are required to provide their customers’ with a way to request and attain the deletion of their biometric data. Failing to comply may lead to hefty fines and reputational damage.
3. Maintain Brand Reputation
Data breaches lead to the loss of customer trust and decrease in client confidence. If customers become aware that your company does not protect their sensitive information, chances are high they will look for another company to fulfill their needs. As a company, the reputation of the brand is of utmost importance; employing data destruction strategies is one of the ways of maintaining this.
Safely Disposing of Biometric Data
It is very important to know how to dispose of biometric data safely. Companies should understand that there are various forms of biometric data disposal methods and choose a method that fits their needs. Here are some ways of disposing of biometric data:
1. Shredding physical copies
Physical biometric data such as fingerprint cards, passport photographs, or maintenance documents are still prevalent within various institutions. These are often stored in files, boxes, or other physical storage. Shredding is one way to ensure physical forms of biometric data are properly disposed of. Shredding means it will not be possible to reassemble papers.
2. Secure digital overwriting
When it comes to digital forms of biometric data, secure digital overwriting deletes the data several times from storage devices, making it impossible to recover. This works because deleting data usually doesn’t erase the actual contents of the file or memory area. It merely locates the necessary space in the memory and marks it as ‘available’.
3. Degaussing:
Degaussing is the technique of utilizing a magnetic field to erase data from storage media. The magnetic field causes any data stored on the medium, whether CD drives, USB drives, or disks, to become unreadable. This erasure works by destabilizing magnetic patterns on the disk, phone, flash drive, and any other magnetically charged data storage devices.
Compliance with Biometric Data Laws and Regulations
Various regulatory frameworks enforce laws on how biometric data is stored, accessed, and disposed of. Organizations have the legal obligation to adhere to these regulations, which include:
1. European Union (EU) General Data Protection Regulation (GDPR)
The GDPR regulates the usage of personal data of EU citizens, necessitating data processors to provide transparent information and consent on biometric data. GDPR also outlines measures for consent revocation and deletion, subject on request, and principles of data minimisation, purpose limitation, and accountability.
2. Illinois Biometric Information Privacy Act (BIPA)
BIPA regulates the collection, usage, storage and disposal of biometric data in Illinois. The law stipulates that any company that collects biometric data must inform people of how the data will be processed, and written consent must be obtained. Companies must destroy such data after utilizing it in a maximum of 3 years. This law emanated after the “technological progression” where the ability to store and collect biometric data arose.
3. Canadian Privacy Act
The Canadian Privacy Act confers the right of consent to citizens and regulates the usage of personal data, which includes sensitive data like biometric data. Companies who collect, utilize, and disclose biometric information of Canadians are also supposed to have in place comprehensive internal policies and procedure of how biometric data will be disposed of.
Conclusion
In conclusion, safe data disposure is vital in protecting the privacy of individuals and companies. Failure to carry out proper data disposal increases the risk of harm to both individuals and the business. Sensitive data such as biometric data requires heightened attention and protective measures, including secure overwriting, physical shredding, and degaussing. Organizations need to comply with laws and regulations such as GDPR, BIPA, and the Canadian Privacy Act to maintain legitimacy, protect customer privacy, and avoid legal action. Ultimately safe disposal of biometric data is a vital aspect of data privacy, and it is imperative in the prevention of personal identity deception, fraud, and corporate damage. Safe storage, reliable access criteria, and transparent procedures are all elements of effective data management which maintain data integrity; we hope this article has informed and correctly hashed out the best practices in biometric data deletion to the benefit of the reader. See you again on another interesting read.
