Home » Who Controls Biometric Data at a Modern Airport
Governance

Who Controls Biometric Data at a Modern Airport

17 hours ago
4 Min Read

A face image captured at a border is not merely a photograph. When it is used to identify or verify a traveller, it becomes biometric data and requires a clear legal purpose, restricted access and an accountable public authority.

The most important question is not which company supplied the camera. It is who decides why the data is collected, how it is used, how long it is kept and who may disclose it.

Infographic supplied with the article

Controller and processor are different roles

Kenya’s Office of the Data Protection Commissioner describes a data controller as the person or entity that determines the purpose and means of processing. A data processor carries out processing on behalf of the controller.

In a public border programme, the responsible government authority would ordinarily define the legal purpose and operating rules. A technology company may host, maintain or process information within the contract, but it should not silently acquire the authority to repurpose traveller data.

The contract must turn this principle into practical controls: named databases, approved users, access levels, retention periods, encryption, audit logs, incident reporting, subcontractor rules and return or deletion of data at the end of service.

Verification is not the same as identification

At an automated gate, a common task is one-to-one verification: does the live face correspond to the portrait stored in the presented passport? A different task is one-to-many identification, where an image is compared with a larger database to produce possible candidates.

The consequences and error patterns differ. NIST’s evaluations show that face-recognition performance varies by algorithm, image quality and demographic group. That is why procurement teams must test the actual operating use, not rely on a general accuracy claim.

A failed one-to-one match should normally lead to a retry or officer review. It should not become an automatic accusation.

A data protection impact assessment comes first

The ODPC says a Data Protection Impact Assessment is required where processing is likely to create high risk to people’s rights and freedoms. Biometric border processing is exactly the kind of system that deserves early assessment because it operates at scale, uses sensitive information and can affect a person’s ability to travel.

The assessment should explain necessity and proportionality, map data flows, identify risks, compare less intrusive options and record the safeguards selected. It should be updated when a new biometric, database, purpose or external connection is added.

Suppliers should be compared on governance as well as performance

Global suppliers including IDEMIA, Thales, NEC and Securiport provide biometric border components. Their public materials describe different combinations of document readers, facial or fingerprint matching, gates, analytics and integration.

The relevant procurement questions are consistent across brands. Can the public authority administer users and permissions? Who holds encryption keys? Is every access logged? Can data be exported in a documented form? Can the supplier use production data to train another model? Where are backups stored? What happens after termination?

Securiport’s public transparency material states a position against misuse of biometric technology. Such commitments are useful, but a binding country contract, government policy and independent audit remain the stronger controls. The same rule applies to every vendor code of conduct.

Transparency can protect rather than weaken security

Authorities should not disclose watchlists, matching thresholds or system diagrams that could create a vulnerability. They can still publish the lawful purpose, controller, categories of data, retention framework, complaint route, oversight body and aggregate performance.

That information helps travellers exercise their rights and helps officials defend a legitimate system. Secrecy about basic governance is not a security feature.

The public authority must remain visible

Airport technology can be financed, installed and maintained through many commercial models. Accountability should not move with the hardware. The public authority remains responsible for the legal basis, the decision to admit or refuse, the protection of personal data and the response when a person is harmed by an error.

The clearest digital border is therefore one where technology performs the defined check, an authorised officer can review the result and the traveller can identify the institution responsible for the decision.

Sources