A new study covering 96 countries has found that the Philippines is the fourth worst country in the world in terms of collection, storage, and use of biometric data.
The survey, undertaken by tech firm Comparitech, identified eight key areas that apply to most countries. Each country has been scored out of 31, with low scores indicating extensive and invasive use of biometrics and/or surveillance and a high score demonstrating better restrictions and regulations regarding biometric use and surveillance.
The Philippines scored just six points to land in the fourth spot, together with the US, Saudi Arabia, United Arab Emirates, Bangladesh, and Uganda.
As expected, China topped the list due to its expansive data collection policies with just two points. Costa Rica and Iran were closely behind at second and third places with three and five points, respectively.
Top 5 worst countries for biometric data collection and use
According to Comparitech analyst Paul Bischoff, these countries received the lowest scores overall, meaning they are showing a concerning lack of regard for the privacy of people’s biometric data. Through the collection, use, and storage of biometric data, these countries use biometrics to a severe and invasive extent, he said.
1. China = 2/31
China only managed to score two points – one for its lack of a biometric voting system and one for its allowance of passport holders from Singapore, Brunei, and Japan to enter the country visa-free for up to 15 days. Its score for not having a biometric voting system also comes with a little irony as the voting system is very heavily controlled, which perhaps rids the need for biometric voting.
Some key areas for concern in China are:
- Its extensive nationwide biometric database is being expanded to include DNA.
- Its widespread and invasive use of facial recognition technology in CCTV cameras. A previous study found that facial recognition cameras are now being used to track and monitor the country’s Muslim minority, Uighurs, among other things.
- Its lack of safeguards for employees in the workplace. Companies have even been permitted to monitor employees’ brain waves for productivity while they’re at work.
- Fingerprints of anyone entering China are taken.
- Some may have hoped that China’s draft personal information protection law would help improve its biometric use. But genetic and biometric data is excluded from the definitions and from within the law.
2. Costa Rica = 3/31
Costa Rica only received 3 points as it is only just beginning to implement facial recognition within the country and it allows a small number of countries to enter visa-free.
Particularly concerning is Costa Rica’s two new national biometric databases. One will include every Costa Rican over the age of 12 and the other every foreigner that enters the country. Police also have full access and both will help facilitate the upcoming facial recognition systems.
At present, the data protection law in Costa Rica doesn’t protect biometric use or recognize biometrics as sensitive data.
3. Iran = 5/31
With widespread use of facial recognition, which is also linked to a biometric database and is accessible by the police, Iran’s use of biometrics is extensive and invasive. It also lacks adequate protections for the use of biometrics and the collection of traveler biometrics is on a large-scale, too.
4. The Philippines, USA, Saudi Arabia, United Arab Emirates, Bangladesh, and Uganda = 6/31
The biggest shock in the bottom 5 is the United States, which ranks as one of the fourth-worst countries for biometric data collection and use. This year, it remains fourth-worst, despite a further 45 countries being included in the study this time.
Most concerning is its lack of a specific law to protect citizens’ biometrics. While there is a handful of state laws that protect state residents’ biometrics (as can be seen in our state privacy study), this does leave many US citizens’ biometrics exposed as there is no federal law in place. And this is despite the widespread and growing use of facial recognition in public places, biometrics within the workplace, and fingerprints for visas.
It’s a similar picture in all of the other fourth-worst countries, with large biometric databases with police access, inadequate or no legislation to safeguard biometric use, and growing/extensive facial recognition use.
5. Iraq and Malaysia = 7/31
Both of these countries have biometrics within their passports, ID cards, and a large biometric database with police access. Neither have a data protection law that considers the use of biometrics and facial recognition CCTV is also largely implemented in these countries.
Top 5 countries for protecting biometric data
While no country provides unwavering protection for its citizens’ biometric data, Bischoff said there are some countries that either haven’t introduced invasive biometric collections or have some safeguards in place. These are:
1. Turkmenistan = 25/31
While Turkmenistan’s appearance at the top of our study may be a surprise, this is likely due to lack of development within the country. For example, no known biometric database exists and the use of CCTV with facial recognition isn’t known. These are two heavy-scoring areas which help boost Turkmenistan’s score. However, Turkmenistan has a data protection law in place which recognizes biometric data as sensitive data. This helps safeguard citizens’, travelers’, and employees’ data from abuse.
2. Ethiopia = 22/31
Similar to Turkmenistan, Ethiopia’s score comes from its lack of biometric use across many sectors. Facial recognition CCTV isn’t known to be in use and while there is a biometric database this is limited to refugees and isn’t used for law enforcement purposes.
Nevertheless, Ethiopia does lack adequate legislative protection for biometrics, so if biometric use were to grow in the country, data protection laws would need introducing to safeguard these.
3. Azerbaijan and Bahrain = 20/31
Neither of these countries have biometric databases and Azerbaijan isn’t implementing widespread use of facial recognition CCTV. Both have legislation which safeguards the use of biometrics. However, Azerbaijan requires biometrics for visa applicants and Bahrain continues to implement widespread use of facial recognition cameras.
4. Portugal and Ireland = 21/31
Both Portugal and Ireland have laws in place to protect biometrics, with Portuguese law also forbidding the implementation of a biometric database. Portuguese citizens’ biometric data may be taken for ID cards but these biometrics are destroyed straight afterward. Only citizens of some countries require visas to enter these counties but these visas may require biometrics (Portugal is part of the Schengen area, for example).
5. Guatemala, Luxembourg, Paraguay, Poland, Romania, Tunisia, and the United Kingdom = 17/31
A large number of countries tie in fifth place. This is primarily due to few (if any) biometric requirements upon entering the country, no national biometric databases, and no extensive use of CCTV with facial recognition. That said, there are areas of concern. These include the growing use of facial recognition CCTV in Tunisia, and a lack of protective legislation in Guatemala, Paraguay, and Tunisia.
Biometric data use for Covid-19 control
Another hugely concerning trend is the use of biometric data under the guise of Covid-19 control, according to Bischoff.
“Interestingly, the rankings don’t change too much as the countries found to have the worst biometric data practices tend to have implemented (or are looking to implement) the most biometric controls for the pandemic,” he said in the report.
Bischoff said China is using drones with facial recognition to monitor people outside their homes during lockdowns, has installed tablets at the front of buses to take peoples’ temperatures and a photo of their forehead, and is looking at facial recognition technology that works without a mask.
With the same number of biometric introductions as China (3), the United States is running a trial in Seattle for palm-scanning payments through Amazon’s One scanner, is looking at fever detection cameras, and is developing facial recognition technology that will work with masks in airports, he noted.
The country with the worst number of facial recognition technologies in use/being developed for the pandemic is the United Kingdom. Its rank drops from 16 to 12 if four possible facial recognition developments are considered, according to Bischoff.
“These are the possible introduction of facial recognition in ‘quarantine hotels’ to make sure people remain in isolation, the use of health passports to create digital certificate/immunity passports, the development of high-resolution cameras that can detect fevers and carry out profiling, and the potential use of biometrics (DNA/fingerprints) upon entry into the country and the extension of their retainment,” he said.
