Some regions have data protection laws. This means in some places the standard security questions (like "What's your mother's maiden name?") are not enough to p

Some regions have data protection laws. This means in some places the standard security questions (like "What's your mother's maiden name?") are not enough to protect people's personal data. (Which is good). However such laws also include access. You cannot use disproportionate means to require access. Biometrics would probably not be legal to protect things like photos etc.