• Home /
• Resources and learning /
• A - Z guidance topics /
• Guidance on complying with the Biometrics Code /
• Rule 6: Access /
• Rule 6 examples

Resources and learning

These scenarios are examples of how an agency might apply rule 6 in context.

Facial recognition by a retail store to operate a watchlist

Topics covered: confirmation of type and access to biometric sample

A store uses FRT to identify individuals on a watchlist of previously violent customers to help improve staff and customer safety.

The store receives a request from two individuals for access to their biometric information:

• The store confirms that the first individual is not on the watchlist. Then, because non-match images are immediately deleted, the store searches and informs the first individual that it does not hold any of their biometric information.
  
  
• The store confirms that the second individual is on the watchlist. It holds a biometric sample (a face image from CCTV still) that was used to enrol the individual on the watchlist. The sample was retained so that the trained staff members can refer to the image to confirm whether a possible match generated by the biometric system is accurate. The store also holds a biometric template of that individual’s face. The store informs the individual that it holds both a biometric sample and a biometric template of their face. It provides the individual with a copy of the CCTV still. The face template cannot be extracted from the system, so the store provides confirmation that it does hold a template related to the individual used to identify if they walk in the store but it is not readily retrievable. 

Fingerprint scan for Multi Factor Authentication (MFA) 

Topics covered: access to biometric template

A business is using a multi factor authentication (MFA) system using employee fingerprints as one authentication factor. An employee makes a request for their biometric information. The employer holds a template of the fingerprint that the system uses to verify the employee’s identity. It is possible to extract the fingerprint template from the system, but it is not something that would be readily understandable (because it looks like a random sequence of numbers).

The employer provides the employee with a copy of the fingerprint template, even though the template is not understandable outside of the context of the system. They also decide to provide a brief written explanation of what the template means and how it is used by the fingerprint recognition system to verify the employee.