May We Speak Privately?
"Privacy is emerging as one of the key issues of the next century." --Commissioner Christine Varney, U.S. Federal Trade Commission, 1997
Privacy is a large and complex concept that encompasses a broad spectrum of freedoms and protections of person, property, and information. When privacy is applied to the use of computing technologies, concerns generally involve the collection, use, and dissemination of personal information.
In Canada and Europe the debate about technology and privacy has produced legislation and privacy guidelines. In the United States, widespread public concern about the power of technology to invade privacy is fairly recent. It flared this past spring and summer in response to revelations about Internet "cookies" that track and record browsing behavior and swirled around the FTC meetings on Privacy and the Internet.
The use of biometric-based technologies, such as speaker verification and speaker identification, has not yet become part of the debate in the United States, but its ultimate inclusion is inevitable. As the only automated tools for authenticating the identity of a person, biometrics can serve as powerful guardians of information privacy.
At the same time, it is difficult to imagine data that are more personal than our voices, fingerprints, DNA, and other sources of biometric identification. Therefore, it is not unreasonable to suggest that voiceprints and other biometric representations be protected by the same privacy provisions covering other personal information. This includes requiring an organization to specify the purpose for which a biometric is being collected, restrict the use of a biometric to the purpose for which it was gathered, and obtain informed consent from an individual before allowing an outside agency access to that person's biometric data.
These guidelines are offered with the knowledge that the rapid technological advances occurring in the 1990s will continue into the next century. Following such guidelines, an organization using speaker verification would inform its employees that it wants to collect voiceprints for the purpose of securing access to a toll-free telephone system. Once created, the voiceprints would not be available for other purposes. For example, they could not be used in the future with 21st century speaker identification and speech recognition tools to monitor conversations occurring over telephones or in conference rooms. The hope is that formal restrictions will inhibit both intentional and unintentional abuses so that biometric data and tools become part of the solution to Commissioner Varney's privacy issue, and not part of the problem.
Judith Markowitz is president of J. Markowitz Consultants, and can be reached at Northwestern University/Evanston Research Park, 1840 North Oak, Evanston, Ill, 60201, or by e-mail at jmarkowitz@pobox.com.