NHRC recommends Chairperson of Kong-ju National University to recall fingerprint recognition system in college library and Minister of Education and Human Resources Development to look into the case and to take appropriate actions
In August of 2004, a petition was filed by Mr. Kang (26, student) with the National Human Rights Commission of Korea (NHRC) against the Chairperson of Kong-ju National University, stating that「the installation of fingerprint recognition system in the central library of the University unduly collects personal information.」In response, NHRC recommended (1) Chairperson of the University to remove the fingerprint recognition system at the automated seating assigning machine for the central library, and to supplement the Personal Information Protection Plan for Kong-ju National University, and (2) Minister of Education and Human Resources Development to look into similar cases in national, public and private colleges and universities across the nation and to take necessary actions for rectification.
The results of the investigation by NHRC are as follows.
(1) Kong-ju National University installed the automated seating assigning machine along with the fingerprint recognition system at the central library in August 2004 to better manage the use of reading rooms and to prevent an individual from occupying a seat exclusively.
(2) The University consulted with the student council and other student groups and accordingly gave students a choice of using either their fingerprint or a password to authorize their entrance into the library. The school has tried to not violate students’ basic rights while operating the school library.
However, (1) the University integrates users’ information into the program of the machine, thereby combining and sharing the information. Therefore, a library manager has the authority to access information on individuals such as reading room usage, fingerprint, personal information and a person’s history of borrowing books. And (2) the University does not have operating rules for the fingerprint recognition system or a separate management guideline and (3) the Personal Information Protection Plan for Kong-ju National University does not prescribe collection, storage, or maintenance of fingerprint information.
In response, NHRC concludes as follows:
1. Requiring sensitive personal information such as one’s fingerprint is not necessary when using the reading room at a library of a national university. Rather, reading rooms in public and national universities should be open to the community because those rooms are regarded as a public asset.
2. The Chairperson of the University and persons concerned insist that registered fingerprint information will be stored into double digit codes, claiming there is no risk of leaking personal information. However, their argument overrelies on technology. For instance, (1) the already created double digit code constitutes identifying information, (2) a possible system failure can occur any time, and (3) a leak of personal information can take place considering the development of technology.
3. When a public organization collects biometric information including individual’s fingerprints, (1) it must collect the least amount of information based on a clear objective within the range necessary for its work. In particular, (2) when collecting sensitive biometric information, a stricter standard beyond attaining a person’s consent needs to be established.
4. The University integrates users’ information into the program of the machine (including the fingerprint recognition system), but it has not prepared its own regulations or guidelines for the installation and operation of the system.
Therefore, NHRC concluded that it is highly possible for the Chairperson’s actions to violate privacy and personal freedom guaranteed under Article 17 of the Constitution.
NHRC recognized the University made efforts to consult with student groups regarding the installation of the reading room system. By doing that, the University allowed students to choose to register their fingerprint in the system or have a password, lessening the violation of human rights. However, NHRC decided that asking students to use their fingerprint when using the reading rooms can violate human rights. To avoid violating human rights, NHRC needed to recommend further measures. Therefore, NHRC recommended the Chairperson of Kong-ju National University and Minister of Education and Human Resources Development to take respective necessary measures. –End-
