FBI Wants to Exempt Its Biometric Data From Privacy Rules

The FBI maintains a large database of biometric information called the Next Generation Identification (NGI) system, which includes fingerprints, iris patterns, photos for facial recognition and other data about millions of Americans. The agency recently sought to have this database exempted from rules laid out by the Privacy Act of 1974, rules intended to protect citizens from privacy violations and give them tools for finding out whether their records are included in the NGI system. This exclusionary bid by the intelligence agency has many civil rights groups concerned.

In May, the American Civil Liberties Union, the Electronic Frontier Foundation, the Center for Democracy and Technology and other organizations wrote a letter to the FBI explaining potential problems this rule change could present. The letter explains that, while many of the records in the NGI system are from criminal cases, it also includes millions of records from people who were subject to background checks for matters such as naturalization documents or job applications. With such a large array of data in this system, advocacy organizations worry that personal information could be used for investigations for which it was never intended.

“The biggest issue here is that the database will contain an enormous amount of biometric data about individuals who are not even suspected of wrongdoing, which will be searched hundreds or thousands of times a day by law enforcement looking for leads,” Gabe Rottman, deputy director of the Freedom, Security and Technology Project at the Center for Democracy and Technology, told Truthdig. “Even a small number of false positives would be an extreme threat to civil liberties.”

The FBI has argued that informing people that they’re in the database could hamper investigations involving people suspected of criminal activity. But records of law-abiding citizens are in the database as well. Rottman points out that the FBI is essentially classifying all NGI records as criminal records and argues that there’s no legitimate reason to exempt much of what’s in the system from Privacy Act protections.

“They shouldn’t be mixing civil and criminal records,” he says. “If you give your fingerprints as part of a job application, they shouldn’t be in a criminal investigative database.”

Neema Singh Guliani, legislative counsel for the ACLU, said this issue has serious implications for activists. “One of the rights outlined in the Privacy Act is if you think the FBI has been collecting your information and violating your First Amendment rights, you can go to court and try to stop them from doing that,” she said. “That’s one of the rights that would be stripped away.” Essentially, an activist who may have ended up in the NGI system for noncriminal reasons could be tracked by the FBI without knowing it.

She added that errors in the NGI data may not be fixed if affected individuals don’t know their information is in the hands of the FBI.

Beyond exempting records from the Privacy Act, Guliani said there needs to be more transparency in the FBI’s record-keeping in this context. “We don’t even have proper information or transparency for what they’re collecting, how the database is being used or what protections apply,” she said.

Another issue privacy advocates are concerned about is that NGI data may be held for a long period of time, well after it’s potentially relevant for criminal investigations. Because the FBI doesn’t necessarily know when the records will be useful for a case, data could be retained indefinitely. As time goes on, the number of people whose data can be tracked could grow exponentially.

The FBI extended the comment period for the rule change from 30 days to 60 days so complaints from the public could be heard, but organizations confronting the problem worry that the exemptions could go through regardless. When the biometric data of millions of Americans is in the hands of an agency that appears to want as little transparency as possible, how personal data is used could threaten the privacy and civil rights of much of the population.