{"id":107153,"date":"2026-02-16T21:55:06","date_gmt":"2026-02-16T21:55:06","guid":{"rendered":"https:\/\/veridas.com\/?p=107153"},"modified":"2026-02-16T21:55:35","modified_gmt":"2026-02-16T21:55:35","slug":"from-data-protection-to-data-control","status":"publish","type":"post","link":"https:\/\/veridas.com\/en\/from-data-protection-to-data-control\/","title":{"rendered":"From Data Protection to Data Control: How Biometrics Must Evolve to Meet the New Privacy Era"},"content":{"rendered":"

For years, privacy in the digital world was treated as a compliance problem. Organisations focused on collecting consent, writing policies, and securing databases. That approach made sense in an era when digital identity was peripheral, and fraud was limited in scale. But that era is over.<\/p>\n

Today, privacy has become a system requirement.<\/b><\/p>\n

Biometrics now sit at the heart of how people access services, exercise rights, and participate in society. At the same time, the risks have multiplied. Data breaches expose millions of identities at once. Artificial intelligence enables large-scale impersonation.<\/b>\u00a0And once compromised, traditional biometric data cannot be changed. In this context, privacy is no longer about how data is stored, but about who controls identity, how it is used, and whether it can be withdrawn.<\/b><\/p>\n

This shift forces a fundamental question: Are current biometric models compatible with the new expectations of privacy?<\/p>\n

Why traditional biometrics struggle in the new privacy landscape<\/h2>\n

Traditional biometric systems were designed for a different world. Their original purpose was to enable interoperability between authorities, standardise documents, and support border control and law enforcement. To achieve that, they relied on fixed, reusable biometric templates that could be stored, compared, and shared across systems.<\/p>\n

In controlled environments, this model worked. In today\u2019s digital, civilian, and user-centric context, its limitations are increasingly evident.<\/b><\/p>\n

Fixed biometric templates concentrate risk. If compromised, they expose individuals permanently. They can often be reused across contexts, enabling correlation and unintended secondary use. And they place the burden of trust on organisations, rather than empowering individuals to control their own identity.<\/p>\n

The problem is not that traditional biometrics are \u201cbad technology.\u201d The problem is that privacy expectations have evolved, and the architecture has not kept pace.<\/b><\/p>\n

Privacy has changed: from consent to control<\/h2>\n

Modern privacy frameworks, such as the GDPR, the EU AI Act<\/a>, and the Charter of Fundamental Rights<\/b>, reflect a deeper shift. Privacy is no longer understood merely as protection against misuse. It is increasingly framed as agency.<\/p>\n

People expect:<\/p>\n

    \n
  1. Their identity to be used only for a specific purpose.<\/li>\n
  2. Their data to be minimised by design.<\/li>\n
  3. Their consent to be meaningful and reversible.<\/li>\n
  4. Their identity to remain under their control, not locked into permanent records<\/li>\n<\/ol>\n

     <\/p>\n

    In other words, privacy today is about sovereignty.<\/b>\u00a0Systems that rely on static, irreversible biometric data struggle to meet these expectations, even when well-intentioned.<\/p>\n

    A paradigm shift: Renewable Biometric References (RBRs)<\/h2>\n

    This is where a new model of biometrics emerges. Renewable Biometric References (RBRs)<\/b><\/a>, as defined in ISO\/IEC 24745:2022<\/b><\/a>, represent a structural departure from traditional biometric templates. Rather than storing biometric traits or extractable representations, RBR-based systems generate abstract, irreversible references derived through artificial intelligence.<\/b><\/p>\n

    These references:<\/p>\n