A long-delayed, over-budget biometric program is set to become the largest centralized database of biometric data collected from Americans and foreigners who have visited the United States.

After being troubled by delays and budget concerns for nearly a decade, the Homeland Advanced Recognition Technology (HART) program will become the US government’s largest biometric database when it launches in September. The program has also been plagued by privacy concerns raised by the Government Accountability Office (GAO), which has warned that HART has “gaps” in its privacy policies.

HART will be managed by the Department of Homeland Security (DHS) and will store and process biometric data such as digital fingerprints, iris scans, and faceprints that have been gathered by DHS and its various sub-agencies. According to DHS, government agencies may seek to access this data for national security reasons, law enforcement, immigration and border management, intelligence gathering, background investigations for national security positions, and certain positions of public trust.

While HART is set to complete “initial operating capability” in September 2026, the system is not scheduled to be fully completed until 2027. The system was originally announced in 2015 as a replacement for the legacy Automated Biometric Identification System (IDENT), which was originally developed in 1994 as a law enforcement system for collecting and processing biometric data from individuals apprehended by border security or immigration officials. In 2013, the DHS’ Office of Biometric Identity Management (OBIM) began plans to replace IDENT with HART. HART was set to become operational in December 2018 but was delayed numerous times due to budget concerns.

Since the initial announcement regarding the transition from IDENT to HART, the GAO and digital rights groups have raised concerns about the government upgrading and centralizing its repository of sensitive personal information of millions of Americas.

In February 2020, DHS published its original HART Privacy Impact Assessment to “assess and mitigate any potential privacy risks.” While the system wasn’t yet active, DHS said they “anticipated potential privacy risks associated with the privacy sensitive system” and “sought to proactively develop appropriate privacy safeguards to be implemented” throughout HART’s development.

In September 2023, the GAO released their own report detailing what it saw as “gaps” in privacy policies required by the Office of Management and Budget. The GAO said DHS implemented only five of twelve privacy requirements. GAO noted that the 2020 privacy impact assessment was “missing key information,” including on whose data will be stored in the system and the partners with whom the system will share the data.

Read More: Homeland Advanced Recognition Technology: The Largest US Biometric Database You’ve Never Heard Of