Comparitech analyzed 50 different countries to find out where biometrics are being taken, what they’re being taken for, and how they’re being stored. Lithuania scored 14/25 in the ranking.
While there is a huge scope for biometric data collection, experts have taken 5 key areas that apply to most countries (so as to offer a fair country-by-country comparison and to ensure the data is available). Each country has been scored out of 25, with high scores indicating extensive and invasive use of biometrics and/or surveillance and a low score demonstrating better restrictions and regulations regarding biometric use and surveillance.
While China topping the list perhaps doesn’t come as too much of a surprise, residents of (and travelers to) other countries may be surprised and concerned at the extent of biometric information that is being collected on them and what is happening to it afterward.
As experts notice, many countries collect travelers’ biometric data, often through visas or biometric checks at airports. Every country studied in the research is using biometrics for bank accounts, e.g. fingerprints to access online app data and/or to confirm identities within the banks themselves. Moreover, despite many countries recognizing biometric data as sensitive, increased biometric use is widely accepted.
It is also noticed that facial recognition CCTV is being implemented in a large number of countries, or at least being tested.
Another key finding leads to EU countries scoring better overall than non-EU countries due to GDPR regulations protecting the use of biometrics in the workplace (to some extent).
5 Worst Countries
These 5 countries received the highest scores overall, meaning they are showing a concerning lack of regard for the privacy of people’s biometric data. Through the collection, use, and storage of biometric data, these countries use biometrics to a severe and invasive extent.
1. China = 24/25
China only managed to scrape back one mark for its lack of a biometric voting system. However, the voting system is very heavily controlled, which perhaps rids the need for biometric voting. It also scored maximum points across all of the other categories for:
Using biometrics in passports, ID cards, and bank accounts.
Not having a specific law to protect citizens’ biometrics.
Its extensive nationwide biometric database is currently being expanded to include DNA.
Its widespread and invasive use of facial recognition technology in CCTV cameras. As our previous study, Surveillance States, found, facial recognition cameras are now being used to track and monitor the country’s Muslim minority, Uighurs, among other things. Beijing is also trialing facial recognition technology at security checkpoints on the subway so it can divide travelers into groups, something they’re hoping to expand to include buses, taxis, and other travel services. And, at the time of writing, China has also introduced facial recognition checks for anyone getting a new mobile phone number.
Its lack of safeguards for employees in the workplace.
Companies have even been permitted to monitor employees’ brain waves for productivity while they’re at work.
The majority of countries require a visa to enter China and all of the visas issued contain biometrics. Fingerprints of anyone entering China are also taken.
2. Malaysia = 21/25
Although Malaysia does fair a little better China, it does still score poorly across all categories due to it:
Having biometrics in passports, ID cards, and bank accounts.
Not having a specific law to protect citizens’ biometrics.
Having multiple biometric databases that the police have access to.
Using facial recognition in CCTV across many areas. Police also use it in their body cameras.
Not having many protections in place regarding biometrics in the workplace, with some extensive use also being seen. This includes collecting biometrics to verify foreign workers’ identities.
Many countries require a visa to enter Malaysia and these visas contain biometrics. Foreigners’ biometrics are also collected when they enter the country.
3. Pakistan = 21/25
While Pakistan does have the same score as Malaysia, this isn’t due to heavy scoring across all categories. Rather, Pakistan does better when it comes to visas as not all visas contain biometrics and no fingerprints are taken when someone enters the country. However, it did score highly for:
Having biometrics in passports, ID cards, and bank accounts.
Having a biometric voting system.
Not having a specific law to protect citizens’ biometrics.
Using widespread facial recognition as part of its “Safe Cities” project.
Having no data protection law in place to safeguard employees’ biometrics.
4. United States = 20/25
The US scores highly in most areas due to:
Having biometrics in passports, ID cards, and bank accounts.
Having a biometric voting system (optical scan equipment used in a large number of states).
Not having a specific law to protect citizens’ biometrics. While there is a handful of state laws that protect state residents’ biometrics (as can be seen in our state privacy study), this does leave many US citizens’ biometrics exposed as there is no federal law in place.
Implementing the widespread use of facial recognition cameras with law enforcement pushing for further use in the identification of criminals. For example, the FBI and ICE have recently been criticized due to their use of facial recognition technology to scan drivers’ license photos without gaining the citizens’ consent beforehand. Equally, some city-level bans have been put in place with San Francisco (CA), Oakland (CA), Berkeley (CA), and Somerville (MA) banning government use of facial recognition technology.
The growing use of biometrics in the workplace. Many companies use employees’ biometrics for certain actions, e.g. using a fingerprint to gain access to a work computer. Again, some state laws offer a little more protection but this still leaves many employees’ biometrics exposed.
Fingerprints being required for most American visas and everyone’s fingerprints being collected upon entry to the country.
5. Taiwan, the Philippines, India, and Indonesia = 19
All four of these countries tie in fifth place with a score of 19 – and all four of these countries are located in Asia.
All of them score highly across most categories except for the Philippines’ CCTV use and Indonesia’s visas.
The Philippines is only talking about the use of facial recognition, but it scores highly in all other areas.
Indonesia lets citizens from a vast number of countries enter the country without a visa. Even when a visa is required, many don’t require biometrics. Nevertheless, Indonesia’s score is brought up by its national database of biometrics, which are taken from ID cards and include fingerprints.
India also has a national biometric database, the largest in the world. This is known as the Aadhaar. However, they avoid a maximum score because law enforcement isn’t permitted to access to the database.
Taiwan’s national database of biometrics includes all citizens’ ID photos and features facial recognition technology, which is used by the police. Due to the absence of fingerprints in the database, however, it avoids an “extreme” score like Indonesia.
5 Best Countries
1. Ireland = 11
Joint with Portugal, Ireland succeeds in protecting biometric data by only having a small database that includes criminal profiles, having extra safeguards for employee biometric data (e.g. consent is not always enough, which goes beyond GDPR requirements), and it isn’t part of the Schengen Agreement so doesn’t take biometrics upon entry. As we have already seen, though, there are some doubts over Ireland’s use of facial recognition CCTV cameras, which are being pulled into question.
2. Portugal = 11
Portugal is the lowest-scoring country (along with Ireland).
In Portugal, biometric databases are prohibited. Therefore, this is the only country to earn a clean sheet in the storage section as there isn’t any form of biometric database. Portugal also scores well for its lack of facial recognition CCTV, protection of biometrics in the workplace, and law that helps protect citizens’ biometrics.
3. Cyprus = 12
Cyprus scores well because, as we have seen previously, it isn’t one of the Schengen countries so it won’t be part of the Entry/Exit System. And, unlike many EU-member countries, it won’t be taking part in the large centralized database. Facial recognition is not implemented in public areas and courts have protected employees’ biometrics within the workplace.
4. United Kingdom = 12
On the whole, the United Kingdom does well because it only has small biometric databases, e.g. one for criminals and one for non-UK citizens who enter the country, and it is governed by GDPR rules. Facial recognition CCTV is also something that seems to be governed well. For example, facial recognition technology was being used at King’s Cross Station but without prior notification (and thus consent). It has now been switched off and plans to develop it further have been placed on hold. It is also being tested in other areas but continues to meet ongoing protests.
5. Romania = 12
With the same score as Cyprus, Romania does particularly well due to its lack of facial recognition CCTV and the fact it isn’t yet part of the Schengen Agreement. However, it is worth noting that Romania is in talks to join, which would increase their score by at least 2 points as biometrics would then be collected upon entry to the country.
Despite most countries having areas of concern, these 5 countries appear to be proactively putting measures in place to try and protect certain areas of biometric data. And with the same score of 12, Switzerland should also be considered with our “best countries” section.
Switzerland = 12
Switzerland is the lowest-scoring of our non-EU countries due to it not having biometric ID cards, voting system, or facial recognition cameras in public areas. It has a specific law in place for biometrics, a criminal-only biometric database, and extra safeguards in place for employee biometrics. Switzerland is part of the Schengen Agreement, however, which means it will become part of the Entry/Exit system in 2020.