Up to now biometric technologies have been operating in various closed environments; by contrast, their use in private transactions will be based on consent. The existing legal framework does not hinder public and private actors from implementing applications. The deployment of biometrics does not threaten procedural rights (i.e. rights in a court of law); their use is deemed intrusive but within reasonable limits and a few unresolved issues arising from the data protection framework have not hindered recent choices for biometrics in European passports. However, their widespread implementation and the fear of a ‘surveillance’ society that may follow from the so-called ‘diffusion effect’ may call for a rethink of the legal tools available. The following four points are briefly described so as to enable a better understanding of the legal implications of biometrics:
The existing legal environment (privacy and data protection) is flexible in that it is an ‘enabling’ legislation legitimising the de facto commercial use of personal data. Data protection rules regulate the use of biometrics but they lack normative content and raise no ethical debate.
Data protection (transparency rules) does not specify what the limits of use and abuse of biometrics are. Opacity (privacy) rules may prohibit use in cases where there is the need to guarantee against outside steering or disproportionate power balances.
As biometrics are diffused in society some concerns are gaining in importance: concerns about power accumulation, about further use of existing data, about specific threats related to the use of biometrics by the public sector, about the failure to protect individuals from their inclination to trade their own privacy with what seems to be very low cost convenience.
It is imperative that biometrics evidence be regulated when presented as evidence in courts of Law so as to protect suspects adequately (e.g. being heard, right to counter-expertise).