Audio Recorded Consent for Biometric Identification

Creating audio-recordings of consent text in the local language to ensure that beneficiaries understand their privacy rights

1.1 billion—or 1 in 7—people globally lack any formal identity, barring access to essential, life-saving services (World Bank, 2017). Without reliable identification, it is incredibly difficult for NGOs and governments to link children to vaccine records, or track healthcare visits for pregnant mothers.

In these cases, fingerprint biometrics has proven to be a promising solution by accurately linking people to their records, and empowering NGOs, businesses, and governments to reach the most marginalised populations. According to the World Bank, UIDAI, the world’s largest biometric scheme in India, has the potential to save over US$11 billion per year in government expenditures through reduced leakage and efficiency gains in public welfare schemes (World Bank, 2016). In Simprints’ own pilot with BRAC in Bangladesh, our deployment of biometrics has led to an increase in maternal healthcare coverage by 38% compared to the control group.

To ensure that biometrics serves the needs of the beneficiaries, it is paramount that their privacy and security be respected. One key step is to obtain explicit consent from beneficiaries prior to the collection of fingerprint data. Simprints currently accomplishes this via simple consent text translated into the local language that frontline workers read aloud to each beneficiary. However, when individuals have low literacy levels and are unfamiliar with concepts like “personal data” and “right to refuse”, as is often characteristic of the last mile, it may be hard for them to understand the importance of informed consent.

To address this issue, our idea for the Mission Billion Challenge proposes the introduction audio-recorded consent conditions in place of, or alongside, the written consent text, ensuring that users truly understand how their data is going to be used. Further, to build credibility for the program, the consent message will be recorded in the voice of a local leader in the local language. By enabling frontline workers to play audio-recorded consent conditions before proceeding to biometric fingerprinting, we can strengthen beneficiary  awareness and understanding of their rights.

To our knowledge, this is the first time that audio-recorded consent will be introduced in biometrics; so far, either consent has not been accounted for at all, or is introduced in text form that frontline workers are trained to read out loud. Our solution prioritises a right that is fundamentally important, while also recognising the operational and sociocultural challenges of implementation. By tailoring consent conditions to the most vulnerable populations, we focus on keeping privacy by design at the centre of biometric identification solutions.

We adhere to the highest available standard when it comes to privacy/data security, that is, Europe's General Data Protection Regulation (GDPR). In practice, this means we take a range of measures to ensure that beneficiaries’ data is collected with their explicit, informed consent, and that their data is secure.

First, to ensure that beneficiaries’ privacy rights are respected, Simprints obtains their consent before the collection of their biometric data via simple consent text translated into the local language and read aloud by the frontline workers.

Second, for every project we conduct an extensive Data Protection Impact Assessment, a questionnaire that exposes every minute risk to personal privacy and examines the lawful base for processing of the project. Going through this process highlights clearly where potential risk areas are and allows us to mitigate them in collaboration with our impact partners. We post all DPIAs publicly on our website.

Third, we follow best privacy-by-design practices in using modern data protection standards (e.g. TLS 1.2, AES and OAuth 2.0), two-factor authentication, and data anonymisation/pseudonymisation across datasets.

Simprints is designed to integrate into existing digital platforms such as CommCare, SurveyCTO, and ONA that are already widely used in the development sector.

Since audio-recorded consent would either replace or be added alongside current consent text within Simprints, it would be part of our plug-in solution.

Design with users has been essential to ensure Simprints works for frontline workers. We spent >700 hours co-creating with users to build scanners that are ergonomic, mobile, rugged, dust-proof, and water-resistant. Our app works offline and plugs directly into data collection platforms used by frontline workers, enabling one seamless workflow that doesn’t require connectivity. These factors are critical where frontline workers spend >12 hours outdoors in harsh conditions, going house-to-house to deliver critical services. Our user-centred approach has been recognised by the Core77 Design for Social Impact Award and 2x BIMA awards (Product and Service Design: Innovation, Advance Award: Innovation).

Simprints has built interoperability into its core architecture so it can support large-scale programmes. Unlike many for-profit biometric companies, Simprints’ software stores data in open-standard ISO 19794-2 biometric template formats. This means Simprints is interoperable with any other biometric technology or initiatives using open standards. For example, Simprints is compatible with India’s national Aadhaar UID programme and Tanzania’s National ID Authority (NIDA) programme, both of which use ISO 19794-2 standards. Thus, Simprints supports—rather than duplicates—existing large-scale ID initiatives, and can be swapped out with alternative vendors if partners choose to do so in the future.

Simprints can be used for enrolment and identification in the field without any internet connectivity. Our scanner connects to the mobile device using bluetooth, and our app runs offline and stores data locally on the phone in an encrypted database.

Simprints can customise the app in the local language and help build capacity on ground to ensure that using the platform is simple and straightforward for frontline workers who use it. Further, audio-recorded consent in the local language empowers beneficiaries to control their personal data by providing them with a better understanding of their privacy rights.

Simprints is contracted to reach >4m beneficiaries across Ethiopia and Bangladesh by 2021. We are in active conversation with various government ministries of health, education, and finance, as well as large development agencies, to reach an additional 10m through national-scale programmes by 2025. As we grow, so would the idea: embedding the element of audio-recorded consent into our solution would strengthen beneficiaries’ understanding of their privacy rights.

We are currently partnering with BRAC, The Children’s Investment Fund Foundation, Mercy Corps, Watsi, Ethiopian Ministry of Health, and Gavi as a digital ID partner on various projects. We have previously won grants from The Bill and Melinda Gates Foundation, USAID, Global Innovation Fund, UKAID, Cisco, and Autodesk.

• Toby Norman, CEO

PhD in Management from the University of Cambridge, Gates Scholar. 2016 Forbes 30 Under 30 Social Entrepreneur, 2017 Schwab Social Entrepreneur of the Year, 2018 GLG Social Impact Fellow.

• Alexandra Grigore, CPO

PhD in Nanoscience from the University of Cambridge, Gates Scholar. 2015 Top 200 Movers & Shakers in BioTech, 2017 Women in Tech winner, 2017 Top 50 Movers and Shakers in BioBusiness.

• Tristram Norman, CTO

MSc with high honors from the University of London. 2016 Forbes 30 under 30 Social Entrepreneur.

Simprints is committed to being an earned revenues-driven organisation. In 2018, 34% of our revenue was sales-based, with the Children’s Investment Fund Foundation and USAID being a few of our key partners. We also secured our first $1m+ sales contract in 2018, and successfully grew our revenue by 9x as compared to 2017. In order to attain financial sustainability as the organisation grows, we are on track to achieving 80% sales-based revenue by 2020.

Our commitment to empowering beneficiaries directly aligns with the goals of the Challenge. Simprints operates across two industries: biometrics/digital ID and international development. Historically, both of them have repeatedly fallen short when it comes to privacy and data security, which has led to large scale breaches of highly sensitive information. Although privacy is often treated as an afterthought in global development, we design and deploy our solutions with respect for beneficiary rights at the centre.

1. Ensuring accurate translation: We need to ensure that consent terms are translated correctly in the local language, including familiar dialects for specific communities, and avoid any scope for miscommunication

2. Obtaining consent recordings from  local leaders: Simprints and our partners need to win the trust of the local leader(s) to be able to obtain the audio-recording in their voice. 

3. Training frontline workers: Beneficiaries cannot be made fully aware of their rights if the consent recording is played at a very low volume, fast-forwarded, or skipped altogether. We need to work closely with our partners to ensure that such risks are avoided.