Biometric Data Definition: 3 Questions a Face Scan Must Answer

Scotland's rulebook for public surveillance cameras was written in 2011. That's before the iPhone 4 hit shelves, before "live facial recognition" was even a phrase anyone used, and before a single Scottish supermarket had a camera that could match your face to a database in real time. Fifteen years later, that same document is still, technically, the guidance in place. Which means the law is trying to referee a game it has never actually watched.

The biometric data definition isn't about the camera or the photo at all. It's about what happens to your face after the scan: who sees the result, why they needed it, and when they delete it.

Here's the thing that trips almost everyone up: people assume "facial recognition" is one technology with one set of risks. Scan happens, face gets checked, done. But that's like saying "a car" describes both a golf cart and an eighteen-wheeler. The camera doesn't tell you the risk. What happens to the image after it's captured tells you the risk. And right now, in Scotland and pretty much everywhere else, one old law is trying to cover technologies that didn't exist when it was written.

What Is the Biometric Data Definition, and Why Doesn't One Law Cover It?

The biometric data definition, in plain terms, means information about your body that's uniquely yours: your face shape, your fingerprint pattern, the sound of your voice. But here's what most guidance skips over: a face scan isn't really "data" until something is done with it. A photo sitting on a hard drive is inert. It becomes biometric data the moment a system turns it into a mathematical template (basically, a set of measurements, like the distance between your eyes or the curve of your jaw, converted into numbers a computer can compare) and does something with that template. And that "something" is where all the actual risk lives.

Scotland's biometrics commissioner recently called for an updated public surveillance strategy, and the reason is almost embarrassingly simple once you see it: the existing framework predates AI-powered video analytics entirely. Current guidance across multiple countries doesn't even agree on what counts as facial recognition. Some definitions cover only identity verification (is this the person they say they are). Others stretch to cover emotion detection, age estimation, and other facial classification, according to a Congress.gov report from the Library of Congress on facial recognition definitions. If your city's rulebook can't even agree on what the technology does, it definitely can't tell you what safeguards you deserve.

The Biometric Data Definition Splits Into Three Very Different Uses

Picture three cameras, all doing the exact same technical thing (capturing your face and comparing it to a reference), but for wildly different purposes. One verifies your identity at an airport gate. One scans a crowd live, looking for a person of interest. One sits above a store entrance, quietly building a profile of how often you shop there. Same lens. Same math. Completely different consequences if something goes wrong, such as a denied boarding, a police stop, or a marketing profile built from repeat visits.

Why Purpose, Access, and Deletion Change the Biometric Data Definition

Let's slow down and actually walk through the three questions that matter, because this is where the whole myth falls apart. Ask yourself: why does the system need my face? Who gets to see the result? And when do they delete it? Answer those three, and you know almost everything about whether a system is reasonable or reckless. Skip them, and "facial recognition" is just a scary word with no shape. This article is part of a series, start with Biometric Data Definition Why Basfs Apple Suit Isnt Privacy .

Purpose changes the entire risk profile. A face check that starts as a simple security gate at a shop entrance can quietly turn into something else entirely: a system tracking your shopping habits, your visit frequency, maybe even feeding a marketing database. Researchers call this scope creep, and it happens in small steps nobody objects to individually. As one expert explained regarding retail facial recognition, society tends to allow things incrementally over time that would feel alarming if introduced all at once, and eventually you end up with layers of privacy-intrusive uses stacked on top of what started as a narrow security measure, according to reporting from ABC News. Nobody voted for the mission creep. It just accumulated.

Access determines who can hurt you if something breaks. A police detective checking one photo against a suspect database, visible only to investigators on that case, is a narrow, defined use. A live camera feeding match scores to a dozen officers in real time, with results kept for general "audit purposes," is a different animal entirely, even if it's running the exact same algorithm underneath. The technology is identical. The exposure isn't.

Deletion is the part almost nobody asks about, and it's the one that should scare you most. Here's the detail that changes everything: faces cannot be encrypted the way passwords can, and unlike a stolen password or credit card number, you cannot simply issue yourself a new face. Data breaches involving facial recognition data raise the risk of identity theft, stalking, and harassment specifically because the biometric can't be changed once it's compromised, according to research cited by Privacy International. Think about that for a second. If your bank card gets cloned, you cancel it Tuesday and have a new one by Friday. If your facial template leaks, there's no replacement card coming. That's your actual face. Forever.

Current laws and guidelines use different facial recognition definitions and terms, ranging from narrow definitions focused on verification and identification to broader interpretations that include emotion detection, age estimation, and other facial characteristic classifications.

Congress.gov, Library of Congress Report on Facial Recognition Policy

How Global Biometric Regulation Handles the Same Question Differently

About 75% of governments worldwide now deploy facial recognition at scale, and roughly 75% of police forces globally have access to some form of it, according to research summarized by CSIS. Yet the legal responses to that deployment vary enormously from country to country. A system that's tightly restricted in one place might be entirely undefined, and therefore effectively unregulated, next door. That gap is exactly what a public strategy is supposed to close, and it's exactly what Scotland's 2011 framework never anticipated needing to close.

The Keycard Test: A Simple Way to Judge Any Biometric Data Definition

Think of a facial comparison system like a hotel keycard. The card itself is just plastic and a magnetic strip, completely neutral on its own. What matters is how the hotel programmed it. Does it open only your room? Only your room for three nights, then it stops working automatically? Does it also open the gym, or every door in the building, forever, with no expiration? A staff master key that opens every room is a different object than a guest key that dies at checkout, even though they look identical.

Facial data works the same way. The image itself is inert. Regulation that just says "facial recognition technology is allowed" or "facial recognition technology is banned" tells you almost nothing useful, because it's regulating the plastic card instead of the programming. Regulation that says "this use expires after the visit, that use requires supervisor sign-off, and this other use gets logged and reviewed" actually protects someone. That's the whole shift in thinking: stop asking whether the camera exists, and start asking how the card is programmed. Previously in this series: What Is Voice Cloning 3 Seconds Of Audio Fakes A Family Call.

Correcting the Biggest Myth: "If It's Legal, It Must Be Governed"

Here's where most people get tripped up, and honestly, it's an understandable mistake. We're trained to think "legal" means "someone thought this through and put guardrails around it." That's true for things like food safety or car seatbelts. But biometric technology moved faster than most legislatures could write rules for it. Scotland's own commissioner pointed out that the current strategy predates AI-powered video analytics and live facial recognition entirely, meaning the law can be technically permissive of capabilities that literally didn't exist when it was drafted, according to the Scottish Biometrics Commissioner.

So "legal" often just means "unregulated," not "safe." Nobody wrote a rule against it because nobody knew to write one. That's not a conspiracy or corporate loophole hunting, it's just the ordinary lag between invention and legislation. The fix isn't outrage. It's asking better questions before assuming a green light means someone already checked for you.

This is a big part of why teams that study facial recognition professionally, including groups like CaraComp that track how these systems get deployed in the real world, keep coming back to the same three-part checklist instead of a yes-or-no verdict on the technology itself. It's not about whether facial comparison exists somewhere in a system. It's about whether that specific use has a defined purpose, a limited audience, and a deletion date. That's the entire biometric data definition that actually matters to you, day to day.

What a Real Public Strategy Should Require

A workable public strategy doesn't need to ban facial comparison outright, and honestly, most proposals don't ask for that. What they ask for is narrower and more useful: separate rules for separate purposes. Verification for a license shouldn't be governed the same way as live scanning of a crowd. Consent also isn't one blanket agreement, either. Real consent for biometric processing needs to be explicit, informed, and specific to the actual use, not just a general nod toward "we use cameras here," according to analysis from Privacy International. Consent for a photo is not automatically consent for a facial embedding (the numeric template built from that photo). Those are two different asks wearing the same trench coat.

Scotland Biometrics Strategy: What Changes If the Commissioner's Call Succeeds

If Scotland adopts an updated strategy, expect it to define facial recognition more precisely, require clear retention limits, and create a path for people to challenge a wrong match. That would put Scotland ahead of the current global average, where regulation is often written for the technology of a decade ago rather than the one running today.

So next time a business, a school, or an app asks to compare your face to something, skip the reflex to just say yes or no to "facial recognition" as a whole. Ask the three questions instead. Why do you need it. Who sees the result. When does it get deleted. A camera that can answer all three clearly is a narrowly defined identity check. A camera that can't answer any of them is an open-ended system quietly deciding what to become next, one small expansion at a time, with nobody in the room to say no.

Biometric Data Definition: Frequently Asked Questions