Biometrics and U.S. / Non-U.S.

Persons Privacy
1
By Richard D. Newbold, JD, MBA, CIPP/G

28 August 2009

Legal Framework

Privacy is not expressly mentioned in the U.S. Constitution but has been argued implicitly through various
2
provisions such as the First, Third, Fourth, Fifth, Ninth, and Fourteenth Amendments. The Constitution is
a contract that one enters into by right of birth or by choice via legal immigration into the United States.
Therefore, Constitutionally-derived rights apply only to a minority of the general population and do not
apply to non-U.S. persons. However, the U.S. Government often extends certain protections and
privileges to other groups outside of the Constitutional framework.

The Fourth Amendment is often cited in conjunction with biometrics. It protects personal privacy and
every citizen's right to be free from unreasonable government intrusion of their persons, homes,
businesses, and property. Domestically, the seizure of a biometric generally requires the consent of the
individual absent probable cause a crime was committed or a demonstration of special government
3
need. Biometric collection activities by DoD often fall into other categories to include the laws of war or
armed conflict. Some collection activity and agreements are handled through diplomatic or other
channels.

Definitions

A “non-U.S. person” is someone who falls outside of the definition(s) of a “U.S. person.” Biometrics are
routinely collected from U.S. citizens and U.S. persons throughout the Federal sector for a variety of
purposes to include passport or visa issuance and employment background investigations. DoD ABIS
operations, on the other hand, involve non-U.S. persons the vast majority of the time (99% +), with
exceptional cases such as dual citizens and personnel recovery missions for military, DoD civilian, and
4
contract employees believed to be in danger of capture or detention.

Under Title 10, War and National Defense, a “„United States person‟ means a citizen of the United States,
an alien lawfully admitted for permanent residence … , an unincorporated association a substantial
number of members of which are citizens of the United States or aliens lawfully admitted for permanent
residence, or a corporation which is incorporated in the United States, but does not include a corporation
5
or an association which is a foreign power …”

Under Title 8, Aliens and Nationality, “[t]he term „lawfully admitted for permanent residence‟ means the
status of having been lawfully accorded the privilege of residing permanently in the United States as an

1
Mr. Newbold is a contractor supporting the DoD Biometrics Task Force. His views do not necessarily reflect the views of the U.S.
Government. This article is not to be construed as legal advice. For more information or to provide comments on this article, please
contact richard.newbold@conus.army.mil or (520) 249-0043.

2
NBSP Publication 0105 “Report on United States Federal Laws Regarding Privacy and Personal Data and Applications to
Biometrics” (March 2006), pg. 13.
3
Id. at 15.
4
DDR&E memo “Personnel Recovery Data in the Automated Biometric Identification System” (6 April 2009)
5
50 USC § 1801(i)
 6
immigrant in accordance with the immigration laws, such status not having changed.” Also defined in
7
Title 8, “[t]he term „alien‟ means any person not a citizen or national of the United States.”

Sometimes definitions appear in several variations in several different statutes. For example, for arms
export control purposes, “U.S. person means a person … who is a lawful permanent resident … or who is
a protected individual... It also means any corporation, business association, partnership, society, trust,
or any other entity, organization or group that is incorporated to do business in the United States [and]
8
includes any governmental (federal, state or local) entity …”

Department of Defense Role

DoD is concerned with both the privacy rights of U.S. persons and the privacy interests of non-U.S.
persons. DoD cannot grant rights to non-U.S. persons that do not exist under U.S law. Privacy interests of
non-U.S. persons are nevertheless important for many reasons aside from any legal requirements, to
include gaining and maintaining the trust of partner nations who may willingly share their biometric data
with DoD with the understanding that it will be stored and shared (or not shared) in an agreed upon
manner.

DoD ABIS is a system of records under the Privacy Act of 1974 (as amended). “[T]he term „system of
records‟ means a group of any records under the control of any agency from which information is
retrieved by the name of the individual or by some identifying number, symbol, or other identifying
9
particular assigned to the individual…” System of records owners incur certain obligations including
publication of notices to published in the Federal Register and Congressional and Office of Management
and Budget reporting requirements.

Individual Privacy

“The term „individual‟ means a citizen of the United States or an alien lawfully admitted for permanent
residence,” and …“[t]he term „record‟ means any item, collection, or grouping of information about an
individual that is maintained by an agency, including, but not limited to, his education, financial
transactions, medical history, and criminal or employment history and that contains his name, or the
identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or
10
voice print or a photograph …”

The DoD Privacy Program defines an individual as “[a] living person who is a citizen of the United States
or an alien lawfully admitted for permanent residence. The parent of a minor or the legal guardian of any
individual may also act on behalf of an individual. Members of the U.S. Armed Forces are „individuals.‟
Corporations, partnerships, sole proprietorships, professional groups, businesses, whether incorporated
or unincorporated, and other commercial entities are not „individuals‟ when acting in an entrepreneurial
capacity with the Department of Defense, but are „individuals‟ when acting in a personal capacity (e.g.,
11
security clearances, entitlement to DoD privileges or benefits, etc.).”
12
The Army is the Executive Agent for biometrics for DoD. The Army Privacy Program requires the
Executive Manager, as system owner, to “[p]rotect, as required by the Privacy Act …, the privacy of

6
8 USC § 1101 (a)(20)
7
8 USC § 1101(a)(3)
8
Traffic in Arms Regulations (ITAR), Subchapter M § 120.15
9
5 USC § 552a
10
Ibid.
11
DoD 5400.11-R, “Department of Defense Privacy Program” (14 May 2007)
12
A 27 December 2000 DEPSECDEF memo “Executive Agent for the Department of Defense (DoD) Biometrics Project designated
the Department of the Army as DoD‟s Executive Agent for “developing and implementing biometrics technology.” DoDD 8521.01E,
individuals from unwarranted intrusion. Individuals covered by this protection are living citizens of the
United States and aliens lawfully admitted for permanent residence. The Army should “[c]ollect only the
personal information about an individual that is legally authorized and necessary to support Army
operations…” and “[d]isclose this information only as authorized by the Privacy Act and [the Army Privacy
Program].”

DoD should also “[k]eep only personal information that is timely, accurate, complete, and relevant to the
purpose for which it was collected” and “safeguard personal information to prevent unauthorized use,
13
access, disclosure, alteration, or destruction.”

The Privacy Act itself is not applicable in the vast majority of cases because of the non-U.S. person status
14
of the subjects whose biometrics are stored in DoD ABIS. However, information assurance statutes,
other Federal policies, and DoD implementation thereof do apply. Although the status of the enrollee may
influence how biometric data and associated biographic information is used or with whom it is ultimately
shared, personally identifiable information such as biometric data in digital form stored on a DoD system
or network is, at a minimum, subject to information assurance requirements and other safeguards.

Department of Defense Biometrics” (21 February 2008) re-designated the Secretary of the Army as the DoD Executive Agent (EA)
for DoD biometrics.
13
DoD 5400.11-R, “Department of Defense Privacy Program” (14 May 2007)
14
10 U.S.C. § 2224, “Defense Information Assurance Program”