FEDERAL BUREAU OF INVESTIGATION
PRIVACY IMPACT ASSESSMENT
COMPUTER AIDED FACIAL RECOGNITION PROJECT
February 19, 2004
This PIA is conducted pursuant to the E-Government Act of 2002, P.L. 107-347, and the accompanying guidelines issued by the Office of Management and Budget (OMB) on September 26, 2003. The PIA provides information regarding the FBI's participation in an English study on the statistics of facial landmark geometry.
The FBI has reviewed the Computer Aided Facial Recognition Project. Taking into account the need for this project and the privacy risks and protections discussed herein, the FBI's Senior Privacy Official approves the FBI's participation in this project.
This project is a scientific and technical research project designed to assist the University of Sheffield in conducting studies on the statistics of facial landmark geometry. To implement this project, the University of Sheffield will collect facial images and other biographical data from voluntary participants. Each participant will receive an information sheet explaining the purpose of the study. Additionally, each participant will be required to execute a consent form authorizing the collection and use of the information to conduct scientific and technical research in the United Kingdom (U.K.) and elsewhere. Participants are free to withdraw from the study at any time. Upon withdrawal, the participant's facial images and other biographical data will be removed from the databases and will be destroyed.
As the study is taking place in England, it is likely that all participants will be British citizens. However, as there is always the possibility that an American citizen or lawful permanent resident will take part, we have treated this project as subject to the Privacy Act (5 U.S.C. § 552a).
A. What information is to be collected?
To implement the study, the University of Sheffield will create two databases. The facial image database will be delivered to the FBI upon completion of the study. It will consist of 2-dimensional images of subjects' faces, 3-dimensional data recordings of the subjects' faces, biographical information about each subject (specifically, the sex, age, ethnicity, and family relationship to other study subjects), and a unique identifier number.
A second database, the name database, will be created and maintained by the University of Sheffield and kept separate from the facial image database. It will contain participants' names, email addresses (if provided) and the unique identifier assigned to each participant. The FBI will not have direct access to information in the name database. The purpose of the name database is to ensure that individuals do not participate in the study more than once and to provide a way to remove a participant's data files from the project, upon request.
B. Why is the information being collected?
This project is designed to assist University of Sheffield in conducting studies in the statistics of facial landmark geometry. Specifically, the system is being created to determine if facial landmark geometry (such as the distance between the nose and mouth, the tips of the ears, or some combination of these measurements) can be used as a means to distinguish one person from another. A second goal of the system is to develop a semi-automated tool enabling FBI examiners to extract facial landmark measurements from questioned images (such as, bank surveillance photos) and conduct one-on-one comparisons with known images of a suspect in custody. It is anticipated that FBI examiners will be able to use statistics generated from the study to compare certain unique measurements of questioned and known subjects.
C. What is the intended use of the information?
The 2D and 3D facial images will be analyzed to determine the statistical variation in the geometry of facial landmarks (e.g., the relative spacing between the mouth and nose, width of the eyes, etc.). The researchers plan to assess the viability of differentiating individuals based solely on the geometry of these facial landmarks.
The name database will be used to ensure that individuals do not participate in the study more than once and to provide a way to remove a participant's data files from the project, upon request.
D. With whom will the information be shared?
The University of Sheffield will transmit the image database to the Technical Support Working Group (TSWG), a governmental group that coordinates interagency and international research and development. TSWG contracted with the University of Sheffield on this project. There is no formal contract directly between the FBI and the University of Sheffield. TSWG will not maintain any records in regard to this project and will be in possession of such records only to receive the records from the University of Sheffield and then transmit them to the FBI.
In the future, other qualified researchers interested in the study of biometrics may be granted access to the facial image database for research purposes. The FBI will develop protocols to determine whether and which researchers will be granted such access.
E. What notice or opportunities for consent would be provided to individuals regarding what information is collected and how that information is shared?
Each participant will be provided with an information sheet describing the study and will be required to execute a consent form (copies of both documents are enclosed in this communication). In general, the documents explain that the participants' facial images and biographic information will be kept in a secure database which will be routinely accessed by the project sponsors for use in scientific and technical research. Participants are advised that the facial images will not be used for any purpose other than scientific and technical research; that the images will not be made public or distributed outside of the scientific, technical or research community; that the sponsors will not publish any other personal information with the images that will allow identification; and that their names and email addresses will be stored in a secure database separate from the database containing the facial images and biographical information which will be controlled by the University of Sheffield.
If requested by a participant, the University of Sheffield will be responsible for removing appropriate records from both databases and for alerting the FBI of the need to remove appropriate records from any versions of the facial image database that have been delivered to the FBI.
F. How will the information be secured?
All technical development in this project is being undertaken by the University of Sheffield and its research partners in the United Kingdom, under contract to the Technical Support Working Group (TSWG). The name database will not be transmitted to the FBI. Once the image database is transmitted to the FBI, that information will be secured by password-protected role-based access.
G. Is a system of records being created under section 552a of title 5, United States Code, (commonly referred to as the "Privacy Act")?
The name database, containing each participant's name, email address and unique identifying number, will not be delivered to or accessed by the FBI. It will be created and maintained by the University of Sheffield. Thus, as it does not appear that the FBI will maintain or control the name database, the Privacy Act is not implicated in regard to this portion of the information.
The data collected in the facial image database, which will be delivered to the FBI, will include photographs and unique identifiers assigned to each participant. The facial images are identifiable information about individuals and, therefore, are Privacy Act records. The facial image database will not contain the participant's names or email addresses, and Computer Aided Forensic Facial Recognition Project users will not be able to retrieve data by searching the facial images. Rather, the information will only be retrieved by the unique identifier or other biographical data, such as, sex, age, ethnicity, and family relationship to other study subjects. Although this information will not be linked to the names of the participants, it will be linked to the facial images, and prudence dictates that this system be brought into the Privacy Act system notice for the FBI's Central Records System (CRS).
Privacy Conclusion
The FBI has reviewed this file for privacy policy issues and we perceive no unusual privacy concerns at stake here. Only the University of Sheffield's organizers will have access to the information stored in the name database. Access to the facial image database will be limited to the University of Sheffield's organizers and the FBI. In the future, based upon developed protocols, the FBI will determine whether to grant other researchers studying biometrics access to the facial image database.
Furthermore, participation in the study is voluntary. The participants must consent to the collection and particular uses of the information, and they have an opportunity to withdraw from the study at any time. Based on the foregoing, the FBI Senior Privacy Official has determined that any privacy issues involved are diminished by the controls in place for this project which restrict access to personal information to a limited group of individuals for research purposes, provide the opportunity for participants to opt out of the study, and require execution of consent by each participant to the use and disclosure of the information.
This is a voluntary database involving limited use and access; as such, the OMB E-Government Act guidance does not require the more extensive PIA analysis that must accompany the development of IT or major information systems.
Based on the foregoing, the FBI Senior Privacy Official has determined that the proposed project presents no noteworthy privacy concerns.
