Biometric Encryption: Creating a Privacy-Preserving 'Watch-List' Facial Recognition System

This paper presents the proof of concept of a facial recognition (FR) system combined with Biometric Encryption (BE) in a watch-list scenario. The system was successfully deployed for Ontario Lottery and Gaming Corporation (OLG) self-exclusion (SE) program. The system is hybrid in nature and comprises a commercial facial recognition module with anonymous templates sequentially combined with a BE module. BE is used to conceal the relationship between a self-excluded person’s FR template and their other personal information (PI). To reveal the corresponding PI record for a matched FR record, BE will attempt to release the pointer key. The FR templates and BE helper data use different biometric feature vectors to prevent interoperability between two modules. In case of a positive match, the final decision is made by a human operator. The BE scheme is based on improved Quantization Index Modulation (QIM) method. It is shown that, unlike other BE schemes, QIM offers a curve of operating points, thus allowing optimal tuning of the entire system. The simulations were performed on a subset of the CMU PIE face image database and then on the actual live test database involving OLG control group participants (simulating the self-excluded persons) and the general public. The maximum Correct Identification Rate was 91 % without BE and 90 % with BE, while FAR (before manual inspection) was of the order of 1 % (depending on the SE database size) without BE and by 30 % to 50 % lower with BE. This system, which we consider an example of Privacy by Design approach, was shown to enhance patron privacy (both for those on the watch list, and regular patrons), system security, and overall accuracy of the watch list system within the context of the OLG self-exclusion program.