OPERATIONALIZING

1
OPERATIONALIZING
PRIVACY by DESIGN
USING FACIAL RECOGNITION TO IDENTIFY
SELF-EXCLUDERS AT OLG SLOTS AND CASINOS
Les DeSouza, Architecture Emerging Technology
2
Who is ?
Employs almost 20,000 people in Ontario
Lotteries

gt30 Billion
Slots
Casinos
for Ontario Healthcare, Education, and
Infrastructure
Resort Casinos
Bingo
3
WHERES WALDO? is a watch-list of only one
person.
OLGs problem is trying to find 15-thousand
unique self-excluded people in near real-time
while protecting everyones privacy.
Facial Recognition with Biometric Encryption is
our Privacy Enhancing Technology
4
PRIVACY by DESIGN
EXTERNAL NETWORK CONTROLS
INTERNAL NETWORK CONTROLS
APPLICATION CONTROLS
APPLICATION CONTROLS
DATABASE CONTROLS
DATABASE CONTROLS
SE
FR
5
SE
SELF EXCLUSION ID
PRIVATE INFO
BIOMETRIC ENCRYPTION
SELF EXCLUSION ID
PRIVATE INFO
SELF EXCLUSION
WALDO, 1987-09-21, HIDDEN AV, ...

SELF EXCLUSION ID
BIND
FACIAL RECOGNITION
FR-ID, IMAGE
IMAGE
FR-ID, BE TEMPLATE
BIOMETRIC TEMPLATE, FR-ID
HELPER
ENROLLMENT
FR
6
SE
WALDO, 1987-09-21, HIDDEN AV, ...
SELF EXCLUSION ID
PRIVATE INFO
BIOMETRIC ENCRYPTION
SELF EXCLUSION ID
SELF EXCLUSION
SE-ID
-
BE TEMPLATE
UNBIND
FACIAL RECOGNITION
FR-ID, IMAGE
IMAGE
FR-ID
BE TEMPLATE
BIOMETRIC TEMPLATE
HELPER
FR-ID
DETECTION
FR
7
PRIVACY by DESIGN
the 7 Foundational Principles
PRINCIPLE ACTIONS
1. Proactive not Reactive Preventative not Remedial -OLG sponsored research in Biometric Encryption (UofT) -Proof of Concept with iView Systems, IPC, UofT -Measured approach to implementation and regular monitoring of systems.
2. Privacy as the Default Setting -regular patrons images not stored -PI field-level data encryption.
3. Privacy Embedded into Design -system was designed with privacy in mind -full database encryption.
4. Full Functionality Positive-Sum, not Zero-Sum -business requirements balanced with privacy reqmnts -3Cs communication, consultation and collaboration -negligible loss in performance large reduction in false alarms.
8
PRIVACY by DESIGN
the 7 Foundational Principles
PRINCIPLE ACTIONS
5. End-to-End Security Full Lifecycle Protection -multi-layered approach to security and privacy -seamless encryption access control retention policies -concealed linkage between databases.
6. Visibility and Transparency Keep it Open -system has been published in IEEE and IPC paper, and presented at several privacy conferences -independent verification of system controls.
7. Respect for User Privacy Keep it User-Centric -notice of use for FR to casino visitors, and explicitly to self-excluders -OLG privacy contacts and policies published.
9
Les DeSouza Enterprise Architect Architecture
Emerging Technology OLG ldesouza_at_olg.ca olg.ca
Ann Cavoukian and Tom Marinelli
Publication on IPC website ipc.on.ca
Questions ldesouza_at_olg.ca
10
WHY face recognition CAN SOMETIMES FAIL
photo courtesy of All American Pet Brands