13Accountability

13 Accountability

13.1 Code Subscribers shall disclose the purpose(s) for which a biometric system is being deployed.

Note: Refer to Biometrics Institute Privacy Principle 1 as it has closely associated obligations

13.2 Auditing of biometric systems by a third party shall be implemented. The audit must examine compliance with all the Biometrics Institute Privacy Principles, in particular

• access controls and procedures for biometric systems and related systems including personnel procedures relating to enrolment, protection of the biometric and its storage and disposal
• privacy policies including distribution and compliance checking
• staff privacy training and awareness procedures
• review and assurance procedures for privacy and biometrics
• technical systems security
• information protection procedures
• complaint procedures

Note: Refer to Biometrics Institute Privacy Principles 4, and 5.1 as they have closely associated obligations

13.3 A Code Subscriber must consider “end-to-end” privacy management issues when providing a product or service to an information technology system. This is a regime which covers at least the secure collection, storage and transmission of biometrics and any associated records. This also includes privacy audits, privacy impact statements, access control and other procedures related to a holistic privacy policy and procedures regime. This requires biometric providers to take a holistic view of their role in managing privacy across an enterprise.

Note: Refer to Biometrics Institute Privacy Principle 4.1 as it has closely associated obligations

13.4 A Code Subscriber shall conduct privacy impact assessments as part of the planning and management process for biometrics implementation.