Do You Own Your Own Fingerprints? (bloomberg.com) 67
Slashdot reader schwit1 quotes an article from Bloomberg: These days, many of us regularly feed pieces of ourselves into machines for convenience and security. Our fingerprints unlock our smartphones, and companies are experimenting with more novel biometric markers -- voice, heartbeat, grip -- as ID for banking and other transactions. But there are almost no laws in place to control how companies use such information. Nor is it clear what rights people have to protect scans of their retinas or the contours of their face from cataloging by the private sector.
There's one place where people seeking privacy protections can turn: the courts. A series of plaintiffs are suing tech giants, including Facebook and Google, under a little-used Illinois law. The Biometric Information Privacy Act, passed in 2008, is one of the only statutes in the U.S. that sets limits on the ways companies can handle data such as fingerprints, voiceprints, and retinal scans. At least four of the suits filed under BIPA are moving forward... Under the Illinois law, companies must obtain written consent from customers before collecting their biometric data. They also must declare a point at which they'll destroy the data, and they must not sell it... "Social Security numbers, when compromised, can be changed," the law reads. "Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, [and] is at heightened risk for identity theft."
There's one place where people seeking privacy protections can turn: the courts. A series of plaintiffs are suing tech giants, including Facebook and Google, under a little-used Illinois law. The Biometric Information Privacy Act, passed in 2008, is one of the only statutes in the U.S. that sets limits on the ways companies can handle data such as fingerprints, voiceprints, and retinal scans. At least four of the suits filed under BIPA are moving forward... Under the Illinois law, companies must obtain written consent from customers before collecting their biometric data. They also must declare a point at which they'll destroy the data, and they must not sell it... "Social Security numbers, when compromised, can be changed," the law reads. "Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, [and] is at heightened risk for identity theft."
You don't own anything (Score:2, Insightful)
The government can take your things, your land, and your life rather easily. You are just a pawn.
Re: You don't own anything (Score:2, Insightful)
A bit dramatic but yes, this is true. Ownership of anything is defined by power, and unless you have more power than the government you live under, they can take anything from you at anytime. Ownership is a myth...you only get to keep things as long as you keep paying and complying.
Re: You don't own anything (Score:2)
DHS doesn't scare me. The ATF on the otherhand still does. They are way better at making someone dissappear.
Re: (Score:1)
Re: (Score:2)
Re: You don't own anything (Score:5, Informative)
No, ownership is not "defined by power", it is defined by mutual agreement. The more you define ownership by power, the more totalitarian society becomes.
Re: (Score:1)
Re: You don't own anything (Score:1)
Bad news, we need your land. You see, we want to put in a highway where your land is, so we are taking it. If you fight us on this, you will lose. If you physically fight us l, you go to jail. Now get out of your house pawn, we're destroying it tomorrow.
Re: (Score:1)
You forgot to mention the part about paying market value.
Re: You don't own anything (Score:1)
Oh yeah, that totally makes it worth it!
Re: You don't own anything (Score:3)
the parameters can also change. (Score:4, Interesting)
lose a finger in an accident... heart attack alters the pacemaker path... lots of ways for biometrics to say you are not you any more.
Of course you dont (Score:4, Informative)
Once it's put into the system just assume everyone has access to it.
Just because it's supposedly secure now doesn't mean someone wont in the future get in.
Re: (Score:2)
Re: (Score:3)
While that may not be the main point, that the law forbids companies from selling the data to others is meaningless due to hackers. I'm sure they'll use the latest security technology to protect the information, just as they with our passwords and credit cards.
Yes (Score:5, Funny)
I'll give you my fingerprints when you pry them from my cold, dead hands.
Re: (Score:1)
The way to do biometrics right is to leave an actual piece of your hand, say a fingertip. Then when you go to the bank, they can match it to the stump.
What counts as collecting? (Score:2)
Do café's need to get permission to take your entry glasses? Do photographers need permission to photograph a person's face and eyes?
Re: (Score:2)
i, a non expert, do not see much of a difficulty here is separating various kinds of data.
restrictions on use depends on definition of biometric data.
in this context data that allows verification of identity is meant. seems lawyers would have not much trouble in coming up with a workable definition.
i suppose even use of an identity photo in proper context (inside card or passport) should indeed need permission.
--
btw i do think use of biometric data to versify identity is, and always will be, hig
Re: (Score:1)
> Do cafÃf©'s need to get permission to take your entry glasses?
When you're on their planet, yes.
Oh no! They would never "sell" your data. (Score:1)
But unfortunately there was a "breach" the other night, and it's all gone*..
The check is in the mail :-)
*Same MO for weapons transfers in the middle east to the "rebels".
inb4 DMCA Takedown Notices (Score:2)
Depends on the country (Score:5, Informative)
In the EU the data is private and must be handled privately. It can also not been transported out of EU, except in other save countries. Surprisingly due to the PrivacyShield treaty the US is declared to be save. Unfortunately they have no such standards.
Re:Depends on the country (Score:5, Informative)
Also, the EU regulations state that the data should be handled just to fulfull the requirements of the service rendered.
Additionally, if the data is exported to the US it still needs to comply with all EU regulations. The fact that the data moved to a different country has no bearings on what the companies can do with it (they still need to apply the EU regulations).
And if they use 3rd party services for some internal processes that have access to the data, those 3rd party also need to comply.
It is not a "out-of-eu regulation" free card.
Do you own your identity is the question? (Score:5, Interesting)
Currently, that appears to depend on where you live and the laws of that land.
If a fingerprint is recorded as a pattern, can you own that pattern? The answer is no. Practically and legally in the US.
Then an alternate pattern (approximation) will be used and so on...
What about your DNA sequence? What about your hair after a haircut? The answer is no over a long enough time period. Nothing about you will be deemed to be owned by you until the state has ruled it so and then the state ignores that ruling anyway in the interest of convenience or justice or whatever reason dejour until the concept fades. Get used to it, make your money where you can in the meantime, copyright your fingerprints.
Re: (Score:2)
If a fingerprint is recorded as a pattern, can you own that pattern? The answer is no. Practically and legally in the US. Then an alternate pattern (approximation) will be used and so on...
Actually you can own a pattern, apply for a trademark using the print pattern. Then legally defend the hell out of it. Even the approximation of your pattern can be considered infringement on likeness of your trademark. IANAL
Re: (Score:2)
Trademarks allow you to identify your products. It is only "infringing" if people use your trademark to identifying other goods. Beyond that, you have no control over how your trademark is copied or stored.
Re: (Score:2)
In the US at least the state can demand you to give your fingerprints to them: http://www.androidcentral.com/... [androidcentral.com]
That doesn't mean you don't own if of course. But what is owning?
no. already settled law in US. (Score:2)
it's clear for the public sector (Score:2)
Well, it is entirely clear what rights people have to protect their scans of their retinas or the contours of their face from cataloging by the public sector: none right now.
They want the full biometrics (Score:2)
The FBI certainly has no intent to limit their access to just your fingerprints. See for instance https://privacysos.org/blog/fb... [privacysos.org]. .
Got that link from this interview here http://scotthorton.org/intervi... [scotthorton.org]
So I don't know what currently happens to the fingerprint you're using to log in but I'm pretty sure it's soon all going into a central database - and from there to other databases of people with nothing but the best intentions.
The better question is why do people think they ar (Score:2)
Fingerprints should never be shared (Score:2)
Fingerprints should never be shared with any other party unless mandate by the law, like after being convicted of felony and being jailed.
Actually, this whole race for biometrics security is flawn. What parties want, is a way to make sure you are who you claim you are. For that purpose, they do not need to store your actual fingerprints to compare and match. They just need a digital signature which you can conveniently produce from your fingerprints without sending the fingerprints or features of your finge
Stop using them (Score:5, Interesting)
>"Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, [and] is at heightened risk for identity theft."
Which is why fingerprints should never be used for biometrics.
Using fingerprints and allowing a third-party to have access to that data is unacceptable. Fingerprints are left everywhere and can be collected and accessed without your permission. Once collected, that data will NEVER be erased or restricted, regardless of claims or laws. They will like go or leak into huge databases and shared between various government agencies and used however they want for as long as they want. With every crime investigation, you will be searched without probable cause.
There is only one safer and practical biometric I know of- that is deep vein palm scan. That registration data cannot be readily abused. It can't be latently collected like DNA, fingerprints, and face recognition can. You have to know you are registering/enrolling when it happens. You don't leave evidence of the biometric all over the place. When you go to use it, you know you are using it every time. And on top of all that, it is accurate, fast, reliable, unchanging, live-sensing, and cheap. If you must participate in a biometric, this is the one you should insist on using.
Example: http://www.m2sys.com/palm-vein... [m2sys.com]
We all need to realize that IT IS NOT EVERYONE'S BUSINESS WHAT WE ALL DO. And you can't trust latent biometrics with security.
Re: (Score:2)
Yes, difficult to forge. And the full entry says:
"Difficult to Forge Because vein patterns exist inside of the body, it is practically impossible to recreate someoneâ(TM)s biometric template. The sensor of the palm vein scanner needs the hand and blood flow to register an image."
I am not saying we shouldn't use biometrics at all, that is probably unrealistic. And I am certainly not advocating we are forced to identify ourselves wherever we go (that is unacceptable to). But when biometrics are necess
No solution? Also no funny and no insightful (Score:2)
To answer the question of the original topical question with an actual solution:
Yes, and you should own ALL of your personal information. You should be able to store it where you want it and ANY use of your personal information should be according to your preferences. Retention of someone else's personal information without their permission should be regarded as a crime, and when that information is held without permission by a government authority, it should be regarded as a violation of the Fourth Amendme
Re: (Score:1)
Yes (Score:1)
Normally, with a question in the title, the broadly valid answer is "No"
But this is an exception.
Biometrics (Score:1)