Privacy in voice biometrics
Personal data is any information that enables the identification of a specific person. e.g. name and surname, PESEL number, address, date of birth, but also biometric data such as face or voice. Pursuant to the Act of May 10, 2018, each of these data is protected. Personal data protection is a set of laws and regulations designed to protect the privacy* of individuals. The rights concern the methods of processing, creating and collecting personal data, including by companies and service providers. In the era of the development of digital services and artificial intelligence, the protection of privacy, in particular biometric data, takes on a whole new meaning.
The voice is the source of information. Why is it worth protecting?
Voice in biometrics is a source of knowledge about a person. On the basis of the voice, i.e. a unique biometric feature, it is possible not only to identify, but also, according to many studies, thanks to advanced algorithms to determine age, gender, social status and even emotional state or determine the diseases that a given person suffers from. When subjected to effective analysis, it can be used to create even complete profiles of people. Biometric features play a huge role in identifying identity, simplifying everyday functioning in various areas of life, but when they fall into the wrong hands, they can be used in a dishonest way and reveal knowledge that we would not like. Therefore, it is extremely important that biometric data is rationally used and protected. The regulations governing the protection of personal data require constant updating due to rapidly changing market conditions, digital technological advances and the increasing use of biometrics.
Voice samples and security. Real threats
In order to use the voice biometric services, it is necessary to provide your unique VoicePrint, i.e. a voice pattern created on the basis of a voice sample. VoicePrint is an encrypted code consisting of behavioral and physical characteristics, used to verify the identity of the person for whom it was created. Voice samples recorded for the purpose of creating VoicePrint should be collected only with the consent of the person concerned and processed for the purpose for which they were collected, in accordance with the applicable GDPR. Usually, this is additionally regulated by the contract concluded with the client by the service provider (a company or institution providing voice-based services). Importantly, voice samples are used only to create VoicePrints - after creating them, they are immediately deleted. VoicePrints are stored in databases while we are customers. When resigning from the VoicePrint service, they should also be removed from the database. The contract and the method of data storage should guarantee full security of biometric data, similarly to traditional data.
It is worth remembering that voice samples left knowingly or not in the public domain may be tempting to process them and obtain sensitive information. Processing voice recordings (synthesis or conversion) to steal voice is a common practice used by hackers. Progressive research works provide more and more new algorithms to counteract such situations. One of the latest works carried out by BiomterIQ is innovative protections of voice streams, which may soon effectively eliminate voice theft based on recordings.
Is there a place for ethical activities in biometrics?
Ethical issues are a very important point to consider in the context of protecting the privacy of biometric data, including voice.
According to experts from the EP Think Tank (a draft regulation on artificial intelligence), the main problem is the registration of voice samples itself, which involves the creation of a unique biometric template that identifies a given person. Experts believe that "creating biometric templates means converting unique physical features into digital data, which leads to the creation of more and more data and reliance on algorithms. Due to the fact that the features that uniquely identify a person are related to the description of their body parts, their collection and use violates personal autonomy and human dignity. What's more, anyone who in the future comes into possession of templates has the ability to track a person anywhere in the world and for any purpose. Man cannot protect himself from this because he cannot change his identifiers."
And what is your opinion?
Undoubtedly, it seems necessary to create a separate "code" regulating the collection, processing and use of biometric data, while preserving the right to privacy in the broadest aspect of this meaning. The implementation of voice biometrics on a large scale will depend on this - says Director of BiometrIQ Andrzej Tymecki.
*Privacy (from Latin privatus 'personal, pertaining to a person, ordinary, not pertaining to the state') - the right of an individual to live their own life, arranged according to their will, with all external interference limited to a minimum.