Biometric Identification Policy

1. Purpose Biometric identifiers are digital representations of immutable and unique bodily features such as fingerprints, hand or face geometry, iris, retina, and voice patterns used to identify individuals. The immutable quality of the data creates a lifelong risk to the subject individuals should that data be used inappropriately. Thus, the storage of this data presents a significant liability to the university. It is also important to note that biometric identifiers can be used to verify the identity of a person but are not sufficient to authenticate a user and grant authorization to access physical or logical assets
   
   
2. Applicability This policy applies to all instances in which the university collects, stores, or otherwise processes biometric identifiers for identification or authorization purposes. Devices which use biometric identifiers to grant access to an individual device where the identifiers are only stored in an inaccessible form on the device, are not within the scope of this policy.
    
3. Definitions Restricted Data: Data in any format collected, developed, maintained or managed by or on behalf of the University, or within the scope of University activities, that are subject to specific protections under federal or state law or regulations or under applicable contracts. Examples include, but are not limited to medical records, social security numbers, credit card numbers, Florida driver licenses, non-directory student records, research protocols and export controlled technical data.
   
   
4. Policy Statement Biometric identifiers are only used to identify individuals when granting access to selected high-security facilities. Such facilities are primarily used by faculty and staff with limited numbers of students involved in special study, research or employment requiring such access.
   
   1. Biometric identifiers are only to be used as an identifier and must be used in combination with additional identifiers and authenticators (ex: ID card, PIN or password) to grant access to approved facilities and resources.
      
   2. Biometric data and systems storing, processing or transmitting it will be secured in a manner equivalent to UF Restricted Data.
      
   3. Only the following biometric identifiers may be used at UF:
      
      • Any record of friction ridge detail
      • Fingerprints
      • Palm Prints
      • Footprints

History