When you hear “sensitive personal information,” what’s the first thing that comes to mind? Social security numbers? Addresses? Bank account information? It’s time to add a few more to the list: iris movement, facial recognition, fingerprints, voice identifiers and even your blood. Cyber attackers are targeting these deeply personal identifiers, taking privacy violations to a whole new level. Yet, while businesses struggle to secure biometric data, many consumers remain unaware of the growing risk.
Consider this scenario: a company is gathering employees’ facial imagery, but because it’s not properly secured, hackers take the photo captures and use it to impersonate the CEO on a video call. They have enough data to know how the person moves, opens their mouth, and even their patterns of speech.
Sound a bit far-fetched? Fraudsters have been recording manipulating images and video content sold on the black market as far back as 2019. Needless to say, businesses have a lot to lose, and a rising tide saves all boats. When organizations step up their efforts to secure biometric data, they reduce the opportunities for threat actors to exploit real faces, voices and fingerprints.
The ripple effects of biometric breaches
Every day, we see the fallout when data is leaked. It’s all over the headlines and typically followed by a scramble to freeze credit accounts and change passwords. But what happens when a company fails to ethically gather and/or protect the information you can’t lock down?
For the consumer, having your personal information stolen is devastating, especially when it’s information that you can’t change. Not only can it cause severe emotional distress, but it can also lead to identity fraud, blackmail or other criminal activities. But perhaps the worst part is that once your biometric data is out there, it’s out there for good. There’s little you can do to protect it in the first place, especially if organizations continue with the trend of failing to gather consent and respect consumers’ privacy preferences.
Ramifications for businesses include the most obvious ones: legal and financial loss. However, companies found to have violated the public’s trust when it comes to privacy can expect to see reputational repercussions that impact their bottom line. A recent survey found that 75% of respondents said they wouldn’t purchase from an organization they don’t trust with their data.
But what repercussions are specific to biometric data leakage for businesses? While biometric breaches may increase monetary damages or reputational harm due to their highly personal and irreversible nature, it’s important to recognize that biometric information can be used to turn any company into a victim – even the one who was breached originally.
Biometric safety falls on businesses
So, what options exist when it comes to protecting biometric data? Other than “opting out” when given the chance or filing lawsuits against violators, there’s not much action individuals can take. It’s up to businesses to take biometric security seriously.
Regarding the statistic earlier that 75% of organizations did not respect consumers’ privacy preferences. It’s important to note that this isn’t because organizations just don’t care. Data privacy is a hard problem to solve, and legacy technology makes consent management and compliance nearly impossible. Companies need modern solutions to tackle modern problems – here are a few to consider.
1. Invest in the privacy program
Businesses must invest in technology and talent that specialize in tracking state, federal and international regulations, gathering consent from consumers, and honoring consumers’ human right to privacy. With nearly 20 states implementing their own data privacy laws, keeping track of what organizations need to do to be compliant (like gathering consent and respecting it) is not easy. However, with no blanket federal data privacy legislation likely to take hold in the U.S. any time soon, organizations have no choice but to ensure compliance with state laws.
2. Don’t ignore your broader security infrastructure
Next, it’s time to evaluate security. Back-ups, encryption, antivirus software, patching devices and securing wireless networks are just a few of the dozens of ways to keep sensitive data secure.
3. Educate employees on deepfakes and the do’s and dont’s of AI
Finally, as organizations and threat actors alike continue to adopt generative AI tools to accomplish their goals, company leaders must ensure their employees are educated on the dangers of inputting sensitive information into large language models, know how to detect deepfakes, and know the processes for reporting any deepfake encounters.
Cyber attackers are getting more physical and more personal than ever – but if organizations take the protection of biometric data seriously, we can keep the characteristics that make us safe.
