After a quarter-century of doing this kind of thing, I know that they don't. For the message to get through, projects will have to fail, project-managers will have to be sacked, and companies will have to go broke. Only big business and governments that have abandoned their responsibility to the public think otherwise. At the other extreme, 'black-letter law' regulation, with everything embedded in statutory legalese, is no use to anyone except lawyers. The appropriate approach, 'co-regulation' , involves legislation that establishes a framework, and enables codes of practice to be worked through, subject to the framework, but reflecting the realities of the particular circumstances.
Some industries exercise market power and issue codes without meaningful public involvement.
Gradually, some are learning to adopt a constructive approach. The biometric in most cases is recorded somewhere, in a manner accessible to someone. Given that a biometric is a PIN you can never change, biometrics providers and user organisations are busily creating a vast problem for the future. A further and quite fundamental problem is that a biometric, to be usable across large populations, is all but unique. It's therefore a means whereby data trails arising in many contexts can be consolidated, to produce what we used to refer to as a personal profile or dossier.