Accelerate Delivery19 chapters
Voice Biometrics and Privacy Regulations with Douwe Korff
One of the world's leading experts on the privacy regulations that affect consumer Voice Biometrics in North America and Europe (BIPA, GDPR, CCPA, UK DPA).
Matt Smallman, Douwe Korffupdated
Learn from one of the world's leading experts about the key privacy regulations that impact Voice Biometrics implementation in consumer-facing use cases. Covering the key regulations from North America and Europe (BIPA, GDPR, CCPA, UK DPA etc.) Douwe Korff explained how meeting these regulations shouldn't be seen as a barrier, but that compliance can help improve user acceptance and adoption.
Douwe's presentation was followed by an open question-and-answer session hosted by Matt Smallman, where there were many interesting and relevant questions.
Transcript
Matt Smallman
Okay. I'm gonna make a start then, because you don't want to hear much from me. You mostly want to hear from Douwe and this interesting subject we've got lined up for you this afternoon, or this morning, depending on where you're joining from.
Just a quick introduction from me and a bit of housekeeping, and then we'll pass straight over to Douwe. So, my name is Matt Smallman. I'm the author of Unlock Your Call Centre, and my work is helping organisations improve the usability, efficiency and security of their call centre Identification, Authentication and Fraud Prevention processes.
But above all that, my real mission is to help organisations get rid of frustrating, time-consuming and pointless security processes wherever I find them. And for that reason we've established what I call the modern customer security community. Votes and nominations are open for a more catchy title.
But whilst I think I do a great job for my clients, I'm just one person, and we've heard from many people that they want to take advantage of the experience of others to help them along this journey. And they don't think existing forums allowed them to do this in the manner in which they thought was most appropriate, particularly given the sensitive nature of the topics being discussed.
I use the term modern to contrast with what I see as the traditional knowledge-based authentication processes, like mother's maiden name or date of birth, and even transitional approaches like PINs and SMS and passwords that address some of the security challenges of the call centre, but ultimately don't improve the usability and efficiency significantly.
Really, what we're talking about here is modern customer security technologies such as Voice Biometrics, Network Authentication, app-based calling and behavioural analytics, and how organisations might decide what the most appropriate is, implement those and do so effectively for their organisation.
And we're trying to do that in a community-spirited way, so that we share best practice amongst ourselves, which creates engaging content that informs people about this field and about the opportunities that exist in it, which enables them to deliver change for their organisations, which ultimately has impact and improves customer conversations, whatever type of business, whatever type of organisation they might be. And again, hopefully they'll come back and share their experience with us, which then continues to spin this flywheel, which you'll see on the slide to the side.
A few housekeeping rules before we start. First off, everyone's videos are on mute and their audio's off. We have a chat and a Q&A function for this afternoon. So if you have any questions or comments you want to raise, then please do so using either of those functions. Some people prefer one, some prefer the other.
I'll be the moderator of those, and when I think it's appropriate to drop those into Douwe's presentation, I'll do so. But otherwise we'll have a more open discussion at the end. I also want to draw your attention to what we call the Chatham House Rule. Well, we don't call it that, but there is a rule called the Chatham House Rule.
And this is that we want you to be free to use the information you get from the session today, particularly Douwe's prepared remarks, and you're more than welcome to attribute those to him. But neither the identity nor the affiliation of anyone else who might end up speaking, other than me, obviously, should be revealed, or the nature of those conversations. But you are obviously free to use that information, and what comes from it, for your own advantage and your organisation's benefit.
This call is being recorded. There will be an edited version of it that is made available, removing many of those interesting questions that you might get in these sessions, and mostly consisting of Douwe's prepared remarks. So you have to join live to get the benefit of the whole conversation. So that's just an incentive to keep doing that.
3:10 Introducing Douwe Korff
Matt Smallman
So without further delay, I'm delighted to introduce Douwe. Data privacy and privacy regulation concerns are often seen as barriers to adoption of some of these modern authentication technologies, particularly Voice Biometrics, or even an unfair burden that has to be complied with or worked around or fixed.
And I don't for one moment believe that's true, and thankfully Douwe doesn't either. Because the truth is that high-quality, human-centred design delivers both engaged and active users of these services, and is also inevitably, by its very design, going to comply with these regulations in many cases. I view these regulations as a health check, as a sanity check to make sure we've done the right thing, rather than a set of constraints under which we need to design the business processes that make the most of this technology. Now, Douwe has prepared some slides to provide context for our discussion.
And you will get a copy of those afterwards, so you don't necessarily need to take notes. And they're gonna appear where I am right now, at the bottom half of the screen. A quick intro for Douwe, and I'm sure he'll do a bit more in a second. So, I came across Douwe through some of my work with clients dealing with a particularly prickly problem, which a couple of people on the call might be familiar with.
And Douwe was able to provide the most reasoned discussion of the issue, and its basis in multiple different jurisdictions and law, that I'd ever seen. Almost overnight, just out of thin air, out of his mind and his experience in this field. And then when I look back over his CV, I see that he's actually been providing expert advice in the field of privacy, digital security and digital rights since before I left school, which is quite frightening.
In fact, you might even consider some of his early work to have laid the foundations and the groundwork for some of the privacy regimes that we currently have in place. And I see most recently he's also been training information commissioners in some jurisdictions as well.
So I don't think I could possibly find anyone more qualified to speak on this subject, although Douwe is gonna give you a bit more of a flavour of him and his work before he kicks off. So, with that then, Douwe, over to you.
5:06 Useful Resources
Douwe Korff
Thanks very much. If you put the first of my slides on, the cover one: that's not just to blow my own trumpet, but it gives you a few of my affiliations.
I've got a few more, and it gives you some links to two fairly recent publications. One is a handbook on the EU General Data Protection Regulation, which I'm sure all of you have heard of. It's free of charge, and we created it, that is Marie Georges, one of the oldest and most active data protection persons in Europe, and I, to train data protection officers in five European countries.
And Marie and I (by the way, Marie was one of the authors of the 1995 Data Protection Directive, together with Wolfgang, so I know them very well), Marie and I did a sort of extract of the first chapter of that book, which is about the origins and meaning of data protection. Especially people outside Europe
sometimes don't realise what exactly data protection is and where it comes from. So to the extent that you're interested in that, click on those links and you can download those documents. The first is rather a long book, which, by the way, I'm now revising for Oxford University Press in a more expanded version.
And the other one is a good one if you just want to know what these funny Europeans are all about.
Read the full transcript (32 min read)
6:26 Importance of Trust
Douwe Korff
But let me get on with the topic of today. The next slide, please. This is the core of any development in the digital world. What you need is trust. Without trust, the digital environment won't work for you, and it won't work for your clients or for your customers.
It requires three things more than anything: openness, honesty and respect. Respect of the individuals whose personal information you are processing and collecting. And respect means you've got to give them choice, and you've got to give them what the Germans call informational self-determination, best pronounced in the German census judgment of 1983, for those who are particularly interested.
It's quoted in the data protection handbook that I gave you on the front.
7:18 Trust into laws - GDPR, CCPA, BIPA etc
Douwe Korff
Next slide. Before I go into this, let me go on to this one. How are these concepts, transparency, honesty and respect, translated into data protection and privacy laws? As you will be aware, privacy or data protection laws are now in place in the vast majority of countries.
Graham Greenleaf, a marvellous colleague of mine from Australia, does a map and a summary of all the laws in the world. I can recommend that. I haven't put the link in there, but if you type in "Graham Greenleaf privacy laws in the world", you'll get all the links for it. The most important ones are the EU General Data Protection Regulation, which was adopted in 2016 and came into force in May 2018, but some elements are only just now filtering through.
And in the USA, the California Consumer Privacy Act and the follow-up, the CPRA, which came into force just now, on the 1st of January 2023. And also important in the present context is the special Illinois Biometric Information Privacy Act, BIPA. By the way, there are a number of state laws in the United States, four or five, or even more now.
And there are plans, but plans have been going on for a while, for a federal privacy law. The latest one, as you can see, is now also being put forward on a bipartisan basis, which may get further than the other ones. One of the problems, my apologies, is that it might pre-empt the state laws, to the extent that the state laws are very strict at the moment.
A federal law might undercut them, and that would be one of the big battles that might happen at the federal level. There are also some plans in the United States for a federal biometric law, but they have not been very advanced.
9:12 Common Features: Openness and Choice
Douwe Korff
Let's go to the next slide, but I have a comment to make before that.
Before I get to these common features: today's topic is particularly about biometric data, and the European regulators in particular, but also, as you can see from BIPA, some of the American legislators, have been particularly concerned about biometric data, which is pervasive everywhere. I wrote a note on it, which I'll gladly send to you
if you ask for one, for one of Matt's clients, and a company I advise, ValidSoft. They are particularly concerned about certain features of biometrics. First of all, that it's easy to capture biometric information on people without them being aware of it. You can capture my voice right now just by listening to me speaking and recording it.
The second one is that if raw biometric data are used for certain purposes, like authentication, and you lose your raw data, then somebody else can impersonate you. I think it was the Chaos Computer Club in Germany that obtained the fingerprints of the Minister of the Interior from a glass that he'd been holding at a conference, and they said, "We've now got your fingerprint, and no device that uses your fingerprint is secure any more."
It was not completely true, because devices also use liveness checks, but you can see the risk that the European regulators see in this context. The third concern they have is that biometric data, if you have biometric databases created in different contexts, can easily be matched up. And that can create central databases that can be used for a multitude of purposes, which is directly contrary to the very concept of data protection, certainly in Europe, but also increasingly elsewhere, including the United States.
And the fourth is mission creep. If you start using my voice just to authenticate me, that is one thing, but if you now start trying to read my emotions into what I say, then that is a creep, a change in the purpose, a change in what's happening, that I, as the data subject, as the individual, will not normally be aware of.
So, how is data protection implemented in law? And there are interesting parallels there: similarities, in spite of all kinds of differences, between the approaches basically globally. And I'm giving you some examples here from, again, Europe and the United States. There is a duty to inform people.
You can't respect people if you don't tell them what you're going to do with their data. In the EU, Article 13 of the GDPR says you have to give people a long list. It's a long list of very specific information about what you're going to do with data when you collect data from them, and I urge you to read that list. And then you might be worried, but later on I'm going to explain how you can do this compliantly and still practically, in a way that doesn't hamper your operations.
In the United States, sorry, the emphasis tends to be on privacy notices. So companies are required under the CCPA, under BIPA and under all American state laws to put up privacy notices where people can easily note and find out what will happen to the data they provide to that company.
Now, of course, and I'll come to it in the next slide, you have to abide by your privacy notices. Otherwise, the FTC will take action. The second thing is choice. Unless there is a particularly special reason for wanting to use people's biometric data, either because it is required by law, for instance in passports or at borders or things like that, it will be rare that it will be mandatory.
The European data protection authorities speak of using biometrics to gain access to a laboratory where dangerous viruses are being handled. It's that kind of extreme situation. In almost all other circumstances, you will need the consent of the persons concerned, and, crucially, you will need some proof that you have obtained that consent.
The consent must be free, informed and expressed in some way. You can't imply consent. That's not valid consent under the CCPA, the CPRA, the GDPR or BIPA. In BIPA specifically, you have to obtain what's called a written release. There has to be proof that consent has been given.
13:42 Common Features: Honesty and Respect
Douwe Korff
Let's go to the next slide.
Ah, I seem to have misnumbered things. There you are, never mind. The next common feature is honesty and respect. If you have put up a privacy notice, if you have informed people of what you're going to do with their data, then you must stick to that, and you must act in accordance with what you've said.
You must of course also not use dark patterns. That is becoming an increasingly important issue, not just in the context of data protection legislation, but also in the context of the AI Act in Europe. For instance, the Federal Trade Commission in America has taken an interest
in tackling dark patterns. Dark patterns are manipulative ways of making people "consent", in inverted commas, to things they wouldn't consent to if they realised what was going on. And finally, on the introductory things, I should mention an increasing convergence between data protection law, privacy law, consumer protection law and competition law.
You may have noticed that in Europe the competition authorities are taking an increasing interest in the massive platforms like Google and Meta that use so much of the data. So these things converge. They all tend to come down to these principles that I've mentioned earlier: honesty, openness, respect.
15:07 Compliance in practice: Informing
Douwe Korff
Let's go more specifically to the topics of the day. Next slide, please. I hope I'm not taking too much time. So, how do you inform people? I have to put my glasses on, because I can't read this very well. There you are. Especially if you're using a call centre, or trying to obtain people's consent in the context of a call,
it's very difficult, in fact nearly impossible, to provide the information in Article 13, or in the privacy notice in the United States, in the context of a call. The simple thing would be, especially also to obtain that consent and to obtain a record of the consent... the simple thing to do would be to send them either a leaflet in hard copy or a link by email to a website.
And on the website, you provide all the information that the law requires, and that is necessary to be honest and open with your client. The European data protection authorities have stressed over many years that the best way to do this is to provide layered information. You provide top-level information that should at least include who you are, what the data is that you're looking for and what you're going to use it for.
And then beyond that, you go to the next page in the leaflet or the next page on the website, and that explains in more detail, for people who want more detail, what exactly you are doing. Are you creating a voiceprint? How long do you retain the data? By the way, retention periods are a crucial issue that people must be informed of, especially under the US law, but also under the European law.
That leaflet, or the link, will then say, "Next time you call us, we will ask you if you've read this information and if you want to be enrolled in the biometric scheme." Next slide, please.
Yes, so the next slide gives the further information. The example I'm giving there, of ValidSoft, is a useful one, because it builds on the normal information that you have. By the way, I've given a link to the European Data Protection Board's guidelines in the previous slide.
Slide six. Maybe you can just go back to that, Matt. That one, the link in blue. I strongly recommend that you read that, and also the Article 29 Working Party's WP193 guidelines on biometric data. Again, I can provide you the data if you like. Look at that, because that gives you the information, the advice on how to inform people and how to do it in a layered form:
upfront information, more detailed information, yet more detailed information. What ValidSoft does is very useful extra information. I'll read it out to you: "The voiceprint we use to authenticate you is irreversible. It cannot be used to recreate your voice." That's a major security assurance, and it addresses that point that the European data protection authorities make.
"And it is doubly unique, in that it cannot be linked to anybody other than you." That's the purpose of authentication, but also it cannot be linked to any other voiceprint in any other authentication scheme, not even another scheme using ValidSoft software. So that guarantee is an assurance in data protection terms, specifically addressing the European data protection authorities' concern about the matching of data.
It was one of the main reasons why ValidSoft got a privacy seal for its Voice Biometrics solution.
18:50 Compliance in practice: Obtaining consent
Douwe Korff
Let's go to the next slide. It's on consent. There's only a few to go, don't worry. As you can see, I'm just taking this from the European Data Protection Board's guidelines on consent. The link is given there. Again, consent can be obtained by ticking a box, an optional box on a website, but of course you must keep a record of that.
It can also be obtained through a reliable, secure record of a recorded oral statement, and that is of course important for how you can do it. And, the last quote there, you can do it in a conference, in a call, but it is difficult. I've addressed that difficulty in the previous slide.
In advance, send information on what you want to do and how you're going to do it. Then you can, in the call, follow up to make sure that the person has understood that, and that therefore the consent is informed and free. And that's explained in the next slide,
with two scenarios. The one in which you have had somebody click on the website: "Yes, I want to use this bank's Voice Biometric authentication. Next time I call, I would like you to enrol me." Of course, the call handler should be informed of the fact that this person has ticked the box. So you've got the record of the consent already, but the sensible thing is to say, "I can see that you've read our page and that you said you agree to be enrolled.
"Is that okay? Shall we do that now?" And then of course you either record the whole conversation, or you keep another record, a log, of the fact that the person again confirms, "Yes, I want to be enrolled," and you keep a record of that. You need that both in terms of the written release under BIPA and in terms of the accountability principle under the GDPR.
In the other scenario, you haven't got a previous record. Somebody has been sent a leaflet. You don't know if they've read it. You don't know if they understood it. When that person calls, the call handler says, "Hello, did you get the leaflet? Did you read it? Do you understand what happened? Is there anything I need to clarify?"
And if they say, "I want clarification," they must of course be able to give that clarification. But if they say, "Oh yeah, I got the leaflet, I'm perfectly happy with it," then that should be recorded in the same way as in the previous scenario, and then you can continue with the enrolment. This is simply a practical demonstration of how you can meet the supposedly very difficult requirements of the law in a very practical way.
That is not a hindrance to the customer, and that will not impede your legitimate activities. That's it. Any questions? Next slide.
Matt Smallman
I'm gonna come back and join us at this stage. Thanks very much, Douwe, for that whistle-stop tour of the regulations. It provoked an awful lot of thoughts in my mind. So I'm gonna start off the questions, and I'm gonna hope that we get some more questions in the chat or in the Q&A.
So, I'm sure many people on this call are already involved in different elements of Voice Biometrics and its implementation, and probably have questions at the forefront of their mind. So do feel free to put those in either the chat or in the question area. If you don't want to be attributed, then use the Q&A feature.
And I think only I can see that, and I won't necessarily name people. Just say, "Please don't mention me."
22:16 Question: BIPA and written consent obtained using website
Matt Smallman
So, oh, we already have a question: "Douwe mentioned a written record required by BIPA. Does a tick box on a website adequately meet this requirement?"
Douwe Korff
The basic answer is yes.
I've got my basic insights into American law from one of the leading American privacy lawyers. I'll not mention him, but he's a good colleague of mine. It's clear in US law that a written record includes an electronically recorded written consent. And yes, you can get the consent from a log of the click.
But only, obviously, provided that the information before the click was very clear and almost explicit. So you must not have a click box that allows people to say, "Oh, I agree," before having even looked at the information. You must first send them to the information page, force them at least to scroll through the information page, and it can be layered.
It doesn't have to be 20 pages of legalese, but at least they must have seen the full page. They must have had the opportunity to look at more detail. If they have done that, then they click and you've logged it. Then you've got valid electronically recorded consent. As I understand it; I'm not giving legal advice in this seminar.
23:33 Question: BIPA exemptions under Gramm-Leach-Bliley Act
Matt Smallman
And I think the other interesting feature of BIPA is just who it's applicable to, so there are a bunch of exemptions under different US regulations. I don't know if you're able to speak a bit more about that.
Douwe Korff
Yes. The first one to mention is that in the United States, banks have been subject to the Gramm-Leach-Bliley Act, the GLBA, for many years.
They fought it in the beginning, but they are now content with it, let's put it that way. And that's got a privacy section in it, called Title V of the GLBA, and all other privacy laws in the United States to date specifically exempt organisations that are subject to the GLBA from their more demanding requirements.
So financial institutions in the United States are by and large subject to the privacy requirements of the GLBA, but not, or at least not fully, to the further-reaching state laws, including BIPA and the CCPA.
24:30 Discussion: Differences between US and EU privacy laws with respect to employees
Douwe Korff
Another big difference with Europe is that in Europe, the whole point of data protection law, and you'll see it in that paper on the origins and meaning of data protection, is that it protects everybody.
Whereas in the United States, privacy laws tend to protect only consumers, and there's a specific definition of consumers. And it only tends to apply to companies dealing with consumers, whereas in Europe any entity, charities, companies, public bodies, that deals with individuals is covered by this generic data protection law.
Those are big differences. So yes, you always have to look. There are also big exemptions for medical institutions that are covered by HIPAA in the United States. So for your particular organisation, you must always carefully check how you are subject to the law. But even if not, go back to my very first slide.
Trust is the core issue. If you want to get the trust of the people you're dealing with, this advice that I've given you, which is not impossible to do, would basically be a good idea to follow anyway, even if you're not legally, completely required to do it. On top of that, at some stage there will be federal privacy laws, and I think they will also apply to the currently exempt organisations.
25:52 Discussion: Importance of informing users to maximise understanding and adoption
Matt Smallman
I just remember, when I first started working in this field more than a decade ago and started to talk about implementations with clients, I used to put up this slide that had the range of offer and consent questions on it. And there's not asking somebody at all.
It is just really weird, because you go from authenticating people by their mother's maiden name and date of birth to suddenly nothing. And that's just really weird. And it sets consumers and customers off going, "Well, what happened? What changed? Is it still secure? Is it not?" So not even informing them is just gonna create more problems for you than not.
And then we used to be on this spectrum and say, so do you inform them? Do you inform them in advance? Do you inform them afterwards? Do you ask them? Do you give them an option to opt out, or should it be an opt-in option? And this was in the absence of a lot of these regulations. I think we've now settled in most jurisdictions on this kind of opt-in model.
And it's the degree of the opt-in-ness that is required. BIPA has some more stringent requirements for what actually opting in looks like. But I think broadly asking people, maybe with a positive spin on it, what they would like to do is the right thing for privacy, personal privacy reasons, but also for the effectiveness of these services.
Douwe Korff
It's perfectly legitimate to say, "If we're using your voice biometric or another biometric, it's more secure and it's more convenient." And people understand that. They will be worried about the security, and you can tell them the kind of things that ValidSoft says: that it is totally secure, it cannot be misused for another thing.
If there is a problem with it, we can re-enrol you: the old voiceprint goes out, we create a new one.
27:15 Discussion: Implications of EU privacy regulations on organisations dealing with EU customers
Douwe Korff
One thing: you were talking about exemptions, and I was talking about the exemptions in US law. The reverse is the case with the EU GDPR. The EU GDPR has extensive application also to companies that are not based in the European Economic Area, in the EU or the EEA.
If you collect information and use information on individuals in the EU or EEA, you are subject to the GDPR, either if you offer them goods or services, or if you collect the data monitoring the behaviour of these people. Typically, having trackers on your website constitutes monitoring of behaviour. So be very aware that EU data protection law, which is still the strictest in the world, can have significant implications for you.
If you don't target people in the EU, the law might not apply. If you only rarely get a visitor from the EU to your website, it might not be strictly enforced. But if you have a website that is specifically also aimed at people in the EU, for instance because you accept payment in euros, or you have a call centre with an EU telephone number, then you must expect that you are subject to the GDPR, and you'll have to comply with the GDPR.
And that's been increasingly strongly enforced, with fines of up to 4 per cent of annual turnover. I don't like to use the stick; I prefer the carrot.
28:52 Discussion: Best practices for informing and obtaining consent from users
Matt Smallman
And just to follow up on that, certainly the best practice that I recommend to clients is always to do this as two steps: to do what I call the offer step first.
And we'll be talking about this in a fortnight's time. It's where you position the service, its features and benefits, and give customers the opportunity to ask questions, before you then move on to the more formal, often disclosure, which is where lawyers and I often fall out over the specific wording. But I'm sure we usually manage to find a happy medium where people are robustly informed.
Douwe Korff
Yeah. There are some good guidelines saying not to use words like "I agree, I agree" in the case of consent. Always have anything is not, you want to have an affirmative action. Absolutely, you're right. Doesn't make many forms, and it can be discussed with people who know how to interact with ordinary consumers in non-legal parlance.
That's quite possible.
Matt Smallman
That's absolutely right. The use of plain English.
Douwe Korff
Yes. Or whatever language is appropriate is essential at this point. Because otherwise it's just plain Dutch as well, uses and overwhelms people.
Matt Smallman
Absolutely.
So, a few other questions that have come up. We'll come back, if we've got time, to cases, because there's a couple of cases in different US jurisdictions around this issue at the moment.
30:06 Question: Does Voice Biometrics when used for Fraud Detection or Prevention require consent?
Matt Smallman
But we've got another interesting question in the chat. I think it's asking about alternative purposes. So, my understanding here, and Douwe can correct me, is that under the GDPR and the UK Data Protection Act, whilst consent is the preferred mechanism,
there are bases, there are cases, when consent may not be appropriate to be gained. And the case I think we're thinking about most here is fraud prevention. If we asked a fraudster, are they happy for us to process their voice in order that we can check that they're not a fraudster,
then they're likely not to give us consent. So, I dunno if you wanna talk about that. I think it's the substantial public interest exemption.
Douwe Korff
Important. There was a problem there with EU law, in that this is covered by Article 23 of the GDPR, which unfortunately says member states may depart from the requirements relating to data subject rights, about informing and consent, when necessary to fight.
The problem with that is it leaves it to the member states exactly how they do it and to what extent they do it, and the different member states have adopted different laws on these exemptions. So yes, by and large you will find in all these laws some exemptions that say you obviously don't have to inform somebody that you reasonably suspect of being a fraudster that you are suspecting him.
But the details depend on the national law. So in that particular respect, you have to crawl through as many laws as you happen to be subject to, and that is really annoying. Another context: the data protection authorities in Europe generally say valid consent is difficult to obtain from your employees, because you're obviously in a hierarchical relation with them.
In some contexts that may not be a problem. For instance, at ValidSoft the employees are asked to participate in trials. They don't have to. They're asked, "Would you like to try it out? We can improve the software if we do it." I don't think there's a problem with that kind of consent.
If it's consent about more tricky things, then there might be a problem. It's resolved in many European countries, not in the UK (well, the UK is not an EU country any more anyway), and not in all, by seeking the advice of the workers' council. In many countries there's a workers' council.
So if you want to introduce biometrics as a means of recording who goes in and out of the building and when that happens, or when people make deliveries, of the delivery drivers and things like that, you discuss it with the workers' council and you come up with a good set of rules for it. For instance,
the driver must be able to switch it off. If he's out of office hours, he's now using the car for his own purposes, and the boss doesn't need to know where his car is out of office hours, but in office hours it should be. Those are the kind of details that you work out in discussions with your employees, and if you do that rightly, you'll be okay as far as data protection law is concerned. But you'll have to look at the national laws.
The US laws tend to have much broader exemptions for fraud prevention.
Matt Smallman
Yeah. So I think in UK law there's a specific basis of processing that is preventing...
Douwe Korff
Yes. Prevention of fraud.
33:12 Discussion: When does a recording in a call centre become biometric data?
Matt Smallman
Yeah. So, just a few more questions that keep popping up, both to me and to other people on the call.
I think one of the interesting challenges I often have when discussing this technology with lawyers and businesses for the first time is this: in call centres, we record calls all the time. We have tons of audio all over the place, and yes, that is personal information.
It may contain personal information, but it's not biometric information. And generally the basis of processing is some kind of disclosure that's been made to the customer, and the business's interest to allow it to do that. So when does a piece of audio become biometric data and therefore require consent?
And that's often the distinction I find people get confused with. I dunno if you want to say anything on that.
Douwe Korff
The European data protection authorities, again, it's that Article 29 Working Party document, WP193, I think, say a pure recording is not yet biometric data. The moment you do something with it in order to uniquely identify a person, it does become biometric data.
So with a recording of this, if somebody gets the audio recording of this event and then says, "Who is that speaker? I've got an awful lot of recordings, I'm going to see if I can identify him. Ah, that's Korff again," that becomes biometric data. So as long as it's purely a recording and you're not using it to identify a person, that's not biometric data.
The definition of biometric data in the GDPR is biometric information when used to uniquely identify a person.
Matt Smallman
Perfect. That's a really great explanation. I will reuse that again.
34:44 Question: On imbalance of power in relationship when obtaining consent
Matt Smallman
We've got another question in the chat. I think it's related to this power imbalance that you talked about with consent,
particularly as it applies to government organisations. A tax authority, for example, has quite a lot of power and influence over you as an individual, and therefore can you ever freely give them your consent?
Douwe Korff
The proper view, if you look at the GDPR, is that certain legal bases do not apply to public authorities.
Public authorities should have a statutory basis for what they're doing, and the law, and the regulations under the law that explain what they can and cannot do, should limit exactly what they do. Now, for instance, my local authority may put on cultural events and allow me to sign up to a newsletter about their cultural events.
They can use my consent for that, because that's not in the exercise of a statutory function that has some kind of direct effect on me. But if it's tax arrangements or other public sector activities, then they will have to have the statutory requirement. The lines are not easy to draw sometimes.
Matt Smallman
Because I think there was quite an interesting case in the UK with HMRC, who implemented Voice Biometrics and did quite a good job of that. But I think there were some weaknesses in their implementation. Notably, I think they didn't actually do a privacy impact assessment before they
launched the service. And they basically didn't allow users not to give consent. It was effectively that you couldn't get past the part of their IVR that was asking for your permission unless you said yes. They just kept asking you. And I think that was subsequently found to be not appropriate, on the basis that customers couldn't give consent freely because they had no other options.
Douwe Korff
And be aware that the UK data protection authority, the Information Commissioner's Office, is much less strict than most of the European ones. If that had happened in France or Italy or Germany, it would've blown up. Somebody high up would've been sacked. The UK ICO tends to be much weaker. And beware:
the whole UK data protection law is likely to start diverging from the EU law, and they may well lose their adequacy decision, their adequacy determination, in a year or so. It's a big problem that the government hasn't woken up to yet.
37:02 Question: When changing or adding a new type of Voice Biometrics technology alongside one with existing consent is the consent still valid?
Matt Smallman
And one final question, because we're coming up on time. If you've got any more, please throw them in the chat. I'm sure Douwe and I can stay on after time for a few more minutes if you want to hear the answers.
Yeah, an interesting scenario has occurred with a couple of clients at the moment. As you probably know, Voice Biometrics has both a text-dependent mode, where you usually have some form of fixed passphrase, and a text-independent mode, where it is generally authentication in the background of the conversation.
And in a couple of cases we've got people who've really made the best of this technology in one of those forms and now want to implement the other form. They've collected consent validly and all the rest of it for one form of the technology, and they now want to implement the other form. And they're left in this position of wondering
to what extent is this a different purpose? Or, under the principles, is this just something I need to tell people I'm doing? Or do I not even need to tell people I'm doing the same thing slightly differently?
Douwe Korff
If the purpose remains the same, "We want to uniquely identify you with your voice",
then with the fact that there is a technical change from active to the broad context in which you speak, I don't think you need... It might be useful to inform people: "We are improving our system. We can now do it without having you speak out specific words." That would be helpful, and it would also mean people would not get suspicious:
"Why am I no longer asked to read out certain numbers or certain words?" So it's always good to be open. I don't think you need new consent, because there's no change in the purpose. A change in purpose would be if you said, "I'm using Voice Biometrics for authentication. I now also want to do emotion detection."
That is an extremely tricky issue. I would warn anybody very strongly against it. You are entering into very hot waters. I'm not saying it can never be done, but I would...
Matt Smallman
I think even the science is to be questioned in that space.
Douwe Korff
Yeah. Even the science. Much trickier. Yeah.
Matt Smallman
That's been fantastic.
We are at time now, and I know people will have to drop off to other sessions. So I wanna thank you very much, Douwe. That was a really informative discussion, and a great set of discussions after that, and some good questions from our participants. I'm glad they were able to ask those.
We may well see you again. I think this is a very hot topic, so thank you very much for your time.
39:25 Upcoming Events
Matt Smallman
Just a quick bit of housekeeping then, for everyone on the call. Oh, can I get us to move forward? So we have a couple more events coming up.
In two weeks' time we have best practices for the enrolment journey. Unfortunately Sam, who was gonna speak on that session, is no longer available. So if someone would like to join the discussion after that, then I'd love to have you. Otherwise, it's just me talking for a while,
which won't be as interesting as if we get to have a discussion like we have today. And then we've also added two new sessions to the calendar that you might not have seen yet. So on April the 20th, just to get my calendar over here, we'll be doing our Voice Biometrics 101, which is basically a primer and introduction to Voice Biometrics and how that might apply to your call centre.
And then, really interestingly, given all the discussion around synthetic voices and the threats from those, we'll be holding a session on May the 4th looking at vulnerabilities in Voice Biometrics, what can be done to mitigate those and how you should properly assess those.
So thank you very much, everyone, for joining us. If you haven't already, you'll receive a feedback request by email. This is session three now of our community. We are still finding our feet, and we would love to get your feedback on what you want to see more of or less of.
So, thank you very much for joining us. Please give us your feedback, either on the feedback form or via email or directly. And once again, Douwe, thank you very much for your time and contribution this afternoon. It's been really useful. Thanks.