{
 "slug": "zero-biometric-workforce-assurance-model-verifying-identity",
 "topic_id": "TOPIC-085",
 "cluster": "Remote Workforce & Insider Threat",
 "tier": "Tier B",
 "title": "Workforce identity assurance that collects no biometric data",
 "summary": "Biometric privacy statutes attach liability to collecting, storing and transmitting biometric identifiers. A platform authenticator does none of those things, which changes the legal analysis entirely.",
 "lede": "An organisation wanting to know that the right person is at the keyboard reaches for facial recognition and runs into statutes with per-violation damages. The same assurance is available through a mechanism that never sees a face.",
 "date": "2024-11-18",
 "category": "Future of Work",
 "author_id": "whit-calloway",
 "tags": [
  "BIPA",
  "biometric privacy",
  "GDPR",
  "workforce",
  "passkeys",
  "employment law"
 ],
 "image_title": "Assurance Without Biometric Collection",
 "schema": "Article",
 "key_takeaways": [
  "Biometric privacy statutes generally regulate collection, storage, transmission and disclosure of biometric identifiers by the organisation.",
  "A platform authenticator performs matching in a secure element on the employee's device; no template reaches the employer.",
  "The employer receives a signature and a flag indicating user verification occurred — neither is a biometric identifier."
 ],
 "body": [
  {
   "type": "h2",
   "text": "What the statutes regulate"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "Where the biometric goes",
   "caption": "The template never leaves the secure element. What crosses the network is a signature.",
   "nodes": [
    {
     "label": "Finger or face presented",
     "note": "on the user's device"
    },
    {
     "label": "Matched in the secure element",
     "note": "template never exported",
     "good": true
    },
    {
     "label": "Private key unlocked",
     "note": "hardware-bound"
    },
    {
     "label": "Signature sent",
     "note": "no biometric crosses the wire",
     "good": true
    },
    {
     "label": "Employer verifies with public key",
     "note": "holds nothing sensitive",
     "good": true
    }
   ]
  },
  {
   "type": "p",
   "html": "Biometric privacy laws vary in detail and share a structure: they impose obligations on entities that collect, capture, store, transmit or disclose biometric identifiers, typically including notice, written consent, retention schedules and destruction requirements."
  },
  {
   "type": "p",
   "html": "Some provide private rights of action with statutory damages per violation, which is what makes them commercially significant. The exposure scales with the number of employees and the number of collections."
  },
  {
   "type": "h2",
   "text": "Where the data actually goes"
  },
  {
   "type": "table",
   "head": [
    "Step",
    "Server-side facial recognition",
    "Platform authenticator"
   ],
   "rows": [
    [
     "Capture",
     "Camera captures the face",
     "Sensor captures the biometric"
    ],
    [
     "Where matching occurs",
     "On the employer's servers or a vendor's",
     "<strong style=\"font-weight:600\">In the device's secure element</strong>"
    ],
    [
     "What is transmitted",
     "An image or a template",
     "<strong style=\"font-weight:600\">A signature and a verification flag</strong>"
    ],
    [
     "What the employer stores",
     "A template, or a vendor holds it",
     "<strong style=\"font-weight:600\">A public key</strong>"
    ],
    [
     "Biometric identifier in scope",
     "Yes",
     "<strong style=\"font-weight:600\">Not collected by the employer</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The third and fourth rows are the analysis. A public key is not a biometric identifier and cannot be used to identify anyone biometrically. The verification flag says a gesture succeeded; it carries no information about the biometric itself."
  },
  {
   "type": "h2",
   "text": "The data protection framing"
  },
  {
   "type": "p",
   "html": "Under general data protection regimes, biometric data processed for unique identification is a special category with a higher bar for lawful processing, and employment contexts complicate consent because of the power imbalance."
  },
  {
   "type": "p",
   "html": "With a platform authenticator the employer is not processing biometric data at all. The biometric processing happens on the employee's device, by the device manufacturer's software, under the employee's control — which is the same arrangement as unlocking their phone."
  },
  {
   "type": "p",
   "html": "The employer processes a public key and signature events, which are ordinary personal data with ordinary obligations."
  },
  {
   "type": "h2",
   "text": "What the employer actually sees"
  },
  {
   "type": "code",
   "text": "# Registration\n  { \"credential_id\": \"...\", \"public_key\": \"...\",\n    \"aaguid\": \"...\", \"registered\": \"2026-03-20\" }\n\n# Each authentication\n  { \"signature\": \"...\",\n    \"flags\": { \"user_present\": true, \"user_verified\": true },\n    \"counter\": 42 }\n\n# What is NOT present anywhere:\n#   an image, a template, a similarity score, a modality\n#   — the employer cannot tell whether the employee used a\n#     fingerprint, a face, or a device PIN"
  },
  {
   "type": "p",
   "html": "The last comment is worth noting. The employer does not learn which verification method was used, which means employees with a reason to prefer a PIN over a biometric are unaffected and unremarked."
  },
  {
   "type": "h2",
   "text": "The employee-choice dimension"
  },
  {
   "type": "p",
   "html": "This design has a property that surveillance-based approaches lack: the employee retains control over their own biometric."
  },
  {
   "type": "ul",
   "items": [
    "They choose whether to enable a biometric or use a PIN on their device",
    "They can change it without involving the employer",
    "They can enrol the credential on a hardware key with no biometric at all",
    "If they leave, the credential is deregistered and nothing of theirs remains with the employer"
   ]
  },
  {
   "type": "p",
   "html": "That is a materially better position for the employee and, not coincidentally, why the legal analysis is simpler."
  },
  {
   "type": "h2",
   "text": "What still requires care"
  },
  {
   "type": "p",
   "html": "Being precise about the limits, because overstating this would be its own problem."
  },
  {
   "type": "ol",
   "items": [
    "<strong style=\"font-weight:600\">Enrolment may still involve biometrics.</strong> If you verify identity documents with facial comparison at onboarding, that collection is in scope and needs the usual consent and retention handling.",
    "<strong style=\"font-weight:600\">Device ownership matters.</strong> Requiring employees to use personal devices raises separate questions about reimbursement and personal device policy.",
    "<strong style=\"font-weight:600\">Authentication events are personal data.</strong> Records of when an employee authenticated are ordinary personal data with the usual obligations.",
    "<strong style=\"font-weight:600\">Jurisdictions differ.</strong> Statutory definitions vary and some are broader than others."
   ]
  },
  {
   "type": "p",
   "html": "The first is the most commonly missed. An organisation can deploy a compliant ongoing authentication mechanism and still have a biometric collection problem at onboarding."
  },
  {
   "type": "p",
   "html": "This describes privacy law at a general level and is not legal advice. Statutory definitions, consent requirements and employment-context rules vary substantially; take specifics to counsel."
  },
  {
   "type": "h2",
   "text": "A worked example: the same control, two architectures"
  },
  {
   "type": "table",
   "caption": "What the employer holds",
   "head": [
    "",
    "Vendor face-match",
    "Platform authenticator"
   ],
   "rows": [
    [
     "Biometric collected by employer or processor",
     "Yes",
     "No"
    ],
    [
     "Template stored off-device",
     "Yes, by the vendor",
     "No"
    ],
    [
     "Written consent regime engaged",
     "Typically yes",
     "Typically not"
    ],
    [
     "Retention and destruction schedule needed",
     "Yes",
     "Nothing to retain"
    ],
    [
     "<strong style=\"font-weight:600\">Breach exposure</strong>",
     "<strong style=\"font-weight:600\">A biometric database</strong>",
     "<strong style=\"font-weight:600\">Public keys</strong>"
    ],
    [
     "Cross-border transfer analysis",
     "Required",
     "Largely moot"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The second column is not a lighter version of the first. It removes the asset that makes the first column expensive."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“The user still uses a fingerprint — surely that counts.”</strong> The statutes attach to collection, storage and transmission by the regulated party. A match performed on the user's own device by the operating system, with nothing exported, is a different act."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“What about employees with no suitable device?”</strong> This is the real operational issue. Hardware security keys work without any biometric at all, and should be offered as a funded alternative rather than a fallback the employee pays for."
  },
  {
   "type": "p",
   "html": "This is a general description of how the architecture differs, not legal advice. Biometric privacy obligations vary by jurisdiction and turn on specific facts."
  }
 ],
 "faq": [
  {
   "q": "Why is a platform authenticator outside biometric statutes?",
   "a": "Matching happens in the device's secure element. The employer receives a public key and a verification flag, neither of which is a biometric identifier."
  },
  {
   "q": "Does the employer learn which biometric was used?",
   "a": "No. The verification flag says a gesture succeeded. Whether it was a fingerprint, a face or a PIN is not communicated."
  },
  {
   "q": "What still needs care?",
   "a": "Identity verification at onboarding may involve real biometric collection, personal device requirements raise separate questions, and authentication events remain personal data."
  },
  {
   "q": "Is this legal advice?",
   "a": "No. Statutory definitions and employment-context consent rules vary substantially by jurisdiction. Take specifics to counsel."
  },
  {
   "q": "Does the employer ever see the fingerprint?",
   "a": "No. The match happens in the device's secure element. What leaves is a signature over a challenge."
  },
  {
   "q": "What about employees who will not use a personal device?",
   "a": "Offer an employer-funded security key. It carries no biometric at all and provides the same assurance."
  }
 ],
 "sources": [
  {
   "t": "Illinois Biometric Information Privacy Act, 740 ILCS 14 (Justia)",
   "u": "https://law.justia.com/codes/illinois/chapter-57/act-740-ilcs-14/"
  },
  {
   "t": "GDPR Article 9 — special categories of personal data",
   "u": "https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e2051-1-1"
  },
  {
   "t": "W3C Web Authentication: An API for accessing Public Key Credentials Level 3",
   "u": "https://www.w3.org/TR/webauthn-3/"
  },
  {
   "t": "GDPR Article 9 — processing of special categories of data",
   "u": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
  }
 ],
 "related": [
  {
   "slug": "keystroke-dynamics-behavioral-biometrics-fail-against-remote",
   "title": "Why behavioural biometrics fail",
   "category": "Future of Work"
  },
  {
   "slug": "dprk-it-worker-laptop-farm-prevention-guide",
   "title": "Hiring one person and employing another",
   "category": "Future of Work"
  },
  {
   "slug": "continuous-authentication-vs-per-action-gating-actually-stops",
   "title": "Continuous authentication versus per-action gating",
   "category": "Comparison"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Assurance%20Without%20Biometric%20Collection/1200_630/blog.jpg",
 "wordcount": 968,
 "url": "/blog/zero-biometric-workforce-assurance-model-verifying-identity.html",
 "reading_time": "4 min read",
 "meta_description": "Biometric privacy statutes attach liability to collecting, storing and transmitting biometric identifiers.",
 "hub": {
  "slug": "topics/remote-workforce-identity",
  "title": "Remote workforce identity"
 },
 "answer": "Yes, and it is the ordinary case rather than a clever workaround. A platform authenticator matches a fingerprint or face locally on the device; what leaves is a signature over a challenge. The employer never collects, stores or transmits a biometric identifier, which is what the statutes regulate.",
 "answer_q": "Can you get identity assurance without touching biometric data?",
 "glossary": [
  {
   "term": "Platform authenticator",
   "def": "Authentication hardware built into a device, where any biometric match happens locally."
  },
  {
   "term": "Biometric identifier",
   "def": "A statutorily defined class of data — typically templates or scans — whose collection triggers obligations."
  },
  {
   "term": "Secure element",
   "def": "Isolated hardware holding keys and templates, which does not export them."
  }
 ],
 "checklist": {
  "title": "Deploying without collecting biometrics",
  "id": "deploy",
  "desc": "Five steps.",
  "steps": [
   {
    "name": "Prefer platform authenticators and security keys.",
    "text": "Matching stays on the user's device."
   },
   {
    "name": "Confirm no template or image reaches you or a processor.",
    "text": "Including through a vendor SDK."
   },
   {
    "name": "Offer a non-biometric option, funded.",
    "text": "Security keys, provided by the employer."
   },
   {
    "name": "Document what you hold.",
    "text": "Public keys and signatures, and nothing else."
   },
   {
    "name": "Keep personal-device policy separate.",
    "text": "Enrolment on a personal device is its own question."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav verifies signatures from platform authenticators and security keys. The protocol has no biometric input and no template store — there is nothing to collect.",
  "href": "../docs.html",
  "label": "See the architecture"
 }
}