DHS OIG audit finds TSA failed to safeguard passenger facial recognition data

What happened

The DHS Office of Inspector General reported a significant weakness in TSA's facial recognition system, noting that the vendor could access and extract sensitive driver’s license and passport images without TSA’s knowledge. The audit found TSA lacked clear policies, did not track data extraction, could not verify proper deletion, and failed to notify passengers of stored biometric data. TSA concurred with the OIG’s recommendations, with one remaining unresolved.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The audit highlights serious privacy and security gaps in the TSA’s biometric surveillance program, underscoring the need for stronger oversight and data handling controls.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Map the security requirements to existing controls and close gaps.
3. Confirm handling of sensitive data categories meets the stricter rules.