Biometric Identifier Protection Standard

Standard Number: 1.11.3.3.2
Category: Information Privacy
Owner: Information Technology Services
Effective: November 17, 2022
Revision History: Originally effective August 30, 2019
Review Date: November 16, 2025

1. Purpose, Scope, and Responsibilities

   1. Biometric Identifiers are biologically unique to an individual and once compromised, the individual has no recourse, is at heightened risk for Identity Theft, and is likely to withdraw from biometric-facilitated transactions. Therefore, pursuant to the Sensitive Data Policy, the University has designated Biometric Identifiers as Sensitive Data.
   2. The purpose of this Standard is to ensure the privacy and Security of Biometric Identifiers collected, stored, and/or used at the University for business and administrative purposes.
   3. This Standard applies to all University employees, students, volunteers, as well as any third-party individuals and entities who are doing work on behalf of the University that generate, have access to, collect, store, or use Biometric Identifiers.
   4. The Chief Information Officer, in conjunction with the Executive Director of Enterprise Support and Chief Information Security Officer, is responsible for implementing and enforcing this Standard.
   5. University Data Stewards are responsible for ensuring the Biometric Identifiers for which they are responsible are classified, kept private, and secured appropriately.
   6. It is the responsibility of Data Users authorized to generate, maintain, and/or access Biometric Identifiers to abide by this Standard. Data Users should avoid collecting, accessing, or sharing Biometric Identifiers whenever possible.

2. Collection of Biometric Identifiers

   1. Information Technology Services (“ITS”) must approve all business units to collect Biometric Identifiers prior to collection. Requests must be submitted to the Executive Director of Enterprise Support.
   2. Biometric Identifiers must not be collected, captured, purchased, received through trade, or otherwise obtained until:
      1. The identity of the individual is confirmed by providing a valid University Identification Card;
      2. The individual, or their legally authorized representative, has been informed in writing that a Biometric Identifier is being collected or stored;
      3. The individual, or their legally authorized representative, has been informed in writing of the specific purpose and length of term for which a Biometric Identifier is being collected, stored, and used; and,
      4. The individual, or their legally authorized representative, has executed a written or electronic release of the Biometric Identifier. See Exhibit A.

3. Storage of Biometric Identifiers

   1. Data Stewards and Data Users must access, share, store, use, transmit, dispose, and protect Biometric Identifiers in accordance with the Sensitive Data Protection Standard and the following requirements:
      1. Biometric Identifiers must only be retained in an ITS-approved information system;
      2. Biometric Identifiers must be encrypted while stored or transmitted;
      3. Access logs must be kept for all information systems that store or transmit Biometric Identifiers; and,
      4. All data processors must employ proper technical and organizational procedures, such as one-way coding, to keep Biometric Identifiers secure.

4. Disclosure of Biometric Identifiers

   1. Biometric Identifiers collected must not be sold, leased, traded, or otherwise profited from.
   2. Biometric Identifiers must not be disclosed, redisclosed, or otherwise disseminated unless:
      1. The individual of the Biometric Identifier(s) or their legally authorized representative consents to the disclosure or redisclosure;
      2. The disclosure or redisclosure completes a financial transaction requested or authorized by the individual of the Biometric Identifier(s) or their legally authorized representative;
      3. The disclosure or redisclosure is required by state or federal law or municipal ordinance.
      4. The disclosure is required pursuant to a valid warrant or subpoena.

5. Secure Deletion of Biometric Identifiers

   1. Biometric access will be disabled within two (2) years of the last consent date, or when the initial purpose for collecting or obtaining such identifiers has been satisfied, whichever occurs first.
   2. Biometric Data will be deleted 105 days after access has been disabled.

6. Exceptions

   1. Biometric Identifiers do not include an X-ray, roentgen process, computed tomography, MRI, PET scan, mammography, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further validate scientific testing or screening.
   2. Biometric Identifiers collected for University research purposes are not subject to the requirements identified within this document.

7. DEFINITIONS

   1. “Biometric Identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry used to identify an individual.
   2. “Data Steward” means the University executive officers or their designees who have planning and policy-level responsibilities for data in their functional areas and have management responsibilities for recognized University Information Systems.
   3. “Identity Theft” means fraud committed or attempted using identifying information of another without authorization.
   4. “Personally Identifiable Information (PII)” means any information that can be used to identify an individual either alone or when combined with other personal information, PII the University considers Sensitive is identified within the Sensitive Data Policy and includes, Social Security numbers, driver’s license numbers, passport or visa numbers, biometric images, and WVU Login credentials.
   5. “Security” means the strategies for managing University Sensitive Data to ensure the confidentiality (the rules that limit access), integrity (the assurance that data will remain uncorrupted), and availability (the assurance that data will continue to be available) of it, including the requirements to collect, store, transmit, and access Sensitive Data.
   6. “University Identification Card” means a University-issued identification card used for accessing University Services and Facilities. The University Identification Card is referred to as the Mountaineer Card on the Morgantown campus, the Catamount Card on the Keyser Campus, and the WVU Tech ID Card on the Beckley campus.

8. Related Documents

   1. Information Privacy Policy
   2. Data Classification Policy
   3. Sensitive Data Protection Standard