Ranking the countries with the best (and worst) biometric data security

• Uses of biometric data such as fingerprints and facial recognition are cropping up in more and more fields – including in monitoring citizens 
• How much is too much biometric monitoring? TechHQ looks at the countries with the widest and the most limited uses of biometric data

We’ve been used to scanning our e-passports in airports for years now (oh, the days when we could travel), but nowadays, biometric security is adding convenience everywhere, from accessing our smartphones with facial recognition to accessing our online bank accounts with fingerprint sensors. We can even verify our identity to insurtech providers by taking selfies, or access government e-services with facial recognition in certain regions.

As consumers and citizens, as we become more comfortable using biometrics – thanks to the seamlessness it can add to digital ID processes and the advances in security it offers over traditional passwords – we shouldn’t forget that we are entrusting more of our most sensitive, personally-identifiable data to both public and private organizations.

As biometric security becomes increasingly commonplace around the world, serious questions will emerge on data privacy and data sharing policies; what the data is being used for, where and how it is being stored, and who will have access to that information. And when it comes to biometrics, data privacy, and security, not all countries take the same approach.

On Data Privacy Day, we explore the top three offending countries in terms of biometric data security and the top three leaders.

Three worst countries for biometric data gathering

China

China is the worst offender when using Comparitech’s metrics, meaning the state displays a concerning lack of regard for the privacy of people’s biometric data. China had facial recognition-equipped surveillance cameras in place all over the country before the pandemic. Now, upgraded systems can even identify faces wearing masks.

For some time now, there has been serious controversy regarding the country’s alleged use of facial recognition systems to track and monitor the country’s minority Muslim community, the Uighurs. Fingerprints of anyone entering China are also collected, and its wide-ranging biometric database is being expanded further to include DNA data.

The country’s employees are also exposed, with companies allowed to monitor employees’ brain waves for productivity while in the workplace. It was hoped that China’s draft personal information protection law would restrict some of these broad invasions, but genetic and biometric data is excluded from the legislation.

Costa Rica

Costa Rica has two new national biometric databases, one that will document every Costa Rican over the age of 12, and the other will track every foreigner that enters the country. And in the controversial area of permitting law enforcement access to track suspected criminals, the Costa Rican police will have full access to both databases, as well as the facial recognition systems that are beginning to come up around the island.

Iran

With the widespread use of facial recognition, which is also linked to a biometric database and is accessible by the police, Iran’s use of biometrics is extensive and invasive. It also lacks adequate protections for the use of biometrics and the collection of traveler biometrics is on a large-scale, too.

Like Costa Rica, Iran doesn’t have a comprehensive data protection law that covers biometrics or recognizes biometrics data as sensitive personal information.

Notable mentions: It is worth pointing out that in fourth place was the US alongside Saudi Arabia, United Arab Emirates, Bangladesh, the Philippines, and Uganda. Specifically, that the US has no law protecting citizens’ biometric data, despite the growing use of facial IDs in public spaces and workplaces, massive data troves of biometric information collected, and limited restrictions for police and other authorities to access the information.

Three best countries for protecting biometric data

Turkmenistan

This surprising entry tops the list not only because it is a developing country with no known biometric database, and so far no wide use of facial recognition CCTV systems, but also because unlike many other countries, Turkmenistan has a data protection law in place which recognizes biometric data as sensitive information, helping secure the data of individuals, workers, and international travelers against potential abuse attempts.

Ethiopia

Similar to Turkmenistan, in Ethiopia, facial recognition surveillance is not known to be in practical use. Ethiopia does have a biometric database, but thus far this has been limited to refugees and has not been extended into law enforcement practices.

However, if biometric usage were to increase in the African nation, its citizens would need better data protection legislation to secure their data rights.

Azerbaijan and Bahrain

Both these countries scored the same in Comparitech’s study as neither have biometric databases, but both have legislation protecting the use of biometric data. The slight drawbacks are that Azerbaijan requires biometrics for visa applicants, and Bahrain continues to implement widespread use of facial recognition cameras.

Notable mentions: The highest-scoring EU countries were Portugal and Ireland in fourth, with laws in place to protect biometrics. Portuguese law even forbids the creation of a biometric database. In addition, the UK ties with a large number of countries for the fifth position, as most of those nations lack any biometric requirements upon entering the country, no national biometric databases, and no extensive use of CCTV with facial recognition.