Using biometrics directly is a terrible idea. Once compromised, they are compromised forever. They aren't like PGP keys which can be revoked. What they should do is use distributed systems that distribute PII back to the source and use biometrics as inputs to SHA256 or some other hashing algorithm. But they won't do that because authority considers its control more important than your security.