Q. What are the privacy requirements for dealing with the biometric data collected?
A:
(i) Establish strong controls for access to, use and transfer of biometric data
Data users should not use an individual’s biometric data for any purpose that is not related to the purpose for which it was originally collected, unless they have the individual’s explicit and voluntary consent to such use, or if such use is exempted from the provisions of the Ordinance.

Written policy and clear guidance should be devised to ensure the proper use of the biometric data collected, and to prevent unnecessary linkage between the biometric database with other IT systems or databases that may result in the transfer or change of use of the biometric data inadvertently.

(ii) Retention of biometric data
Data users should regularly and frequently purge biometric data which is no longer required for the purpose for which it is collected.

(iii) Ensure data accuracy
Data users are required to take all reasonably practicable steps to ensure that the personal data held is accurate.

To ensure the accuracy of the biometric recognition system, data users must ascertain and be satisfied that the false acceptance rate and false rejection rate of the biometric recognition system are within reasonable limits, having regard to the size of the population monitored by the system.

(iv) Secondary use
Data users are required not to use personal data collected for a new purpose without the express consent of the data subject.

Data users collecting biometric data for one purpose must ensure that it is not being used for another unrelated purpose without obtaining express consent from data subject.

(v) Data security
Given the sensitivity of biometric data, it is important that data users guard against any risk of compromising and thieving of the biometric database and that effective security measures are implemented as are reasonably practicable in the particular circumstances.

(vi) Duty to make the privacy policy generally available
Data users should devise privacy policies and procedures setting out clearly the rules and practices that are to be followed in collecting, holding, processing and using biometric data, and make them known to all parties concerned, such as employees, contractors and/or customers.

(vii) Staff training
Proper training, guidance and supervision have to be given to the staff responsible for the collection and management of the biometric data. Employees who fail to properly carry out their duties in the handling of biometric data should be subject to appropriate disciplinary action.

(viii) Use of contractor
If contractors are engaged in the handling of personal data, data users must adopt contractual or other means to prevent personal data transferred to the contractor from being kept longer than necessary and from unauthorised or accidental access, processing, erasure, loss or use.