Does the new data protection framework provide enough safeguards for the protection of citizens' biometric data?

Abstract

This research primarily aims to assess how biometric data is protected under Directive 95/46/EC (the Data Protection Directive) & whether the coming into force of Regulation (EU) 2016/679 (the General Data Protection Regulation) on the 25th of May 2018 will strengthen the safeguarding of the protection of citizens’ biometric data. An overview of what is biometric data and why it should be well protected will also be given; along with a comparative examination of different pieces of legislation in different states within the European Union and third party states that regulate the subject. This will enable the reader to analyse the provisions introduced by the Regulation in the context of how different jurisdictions are protecting biometric data; enabling one to see whether the measures agreed upon in the final text of the Regulation are enough to safeguard citizens or whether some good practices which could have been very beneficial were left out. This research will also look into whether this new approach, a regulation which creates harmonisation in data protection law without the need for implementation in national legislation, will be better to protect citizens’ rights in this field especially in the context of rapid scientific developments and advances in technology making the collection and processing of biometric data easy; which processing is now targeting large populations across the board in several commercial and governmental fields. This research will therefore look into whether this new data protection framework provides enough technical and organisational measures that allow the use of biometric data while mitigating the data protection and privacy risks on European citizens’ privacy and their fundamental right to data protection in this age where this technology is no longer expensive so there are no economic restrains limiting privacy impact of individuals’; as was the situation when the Data Protection Directive was adopted in 1995.