Resources and learning

A woman with short, curly hair flips through a notebook while browsing in a retail store. These scenarios are examples of how an agency might apply rule 13 in context.

Biometric template is assigned as a unique identifier

A retail store is using an FRT system to identify people on a watchlist for staff and customer safety purposes. The retailer generates and records a unique facial template for each person on the watchlist (the reference template). It then uses the reference template to uniquely identify specific people when they enter the store.

In this case, the retailer is assigning the reference templates as a unique identifier because their watchlist system is organised around the reference template as the main identifier for the individual (as opposed to using a name, customer ID or other identifier).

However, the biometric templates generated for individuals walking into the store and used for comparison with the enrolled biometric templates would not be assigned as unique identifiers for the purposes of rule 13 (the probe template). They are only used for a one-off comparison, to determine whether the individual entering the store is on the watchlist (and they may be discarded once the comparison has been made).

Is the store complying with rule 13?

The store is permitted to assign the biometric template as a unique identifier and complies with rule 13 if it applies the relevant controls. The main implication of rule 13 is that the unique biometric template is not transferable to another organisation as their primary means of identifying the person in its systems. However, another organisation could generate its own biometric template to assign to the same individual.

Biometric template not assigned as a unique identifier

A company is using FRT to verify the claimed identity of their customers. They use their biometric system to generate and compare unique facial templates based on the customer’s photo in an identity document and a live selfie of that customer. If the templates are sufficiently similar, above the match threshold, the system will produce a match result.

These facial templates are not being assigned as unique identifiers. The company is not using the biometric templates as the primary means of identifying the individual within the company’s systems but only for the limited purpose of verifying identity at a point in time.