WASHINGTON — Researchers studying data security and consumer privacy are raising new questions about the handling of biometric information collected incidentally through ATM keypads, according to a report circulating among digital rights organizations this week.

The concern centers on latent fingerprint data left on keypad surfaces during routine transactions. While financial institutions do not actively scan or record fingerprints at the point of contact, privacy advocates argue that the data exists physically and that current regulations do not adequately address its potential for collection by third parties.

"The fingerprint is there," said one researcher familiar with the report, who asked not to be identified pending publication. "Whether anyone is capturing it systematically is a different question, but the infrastructure to do so is not hypothetical."

ATM hardware is serviced by a range of contractors and third-party vendors who have physical access to the machines during maintenance windows. The report notes that chain-of-custody standards for keypad components vary widely across the industry.

Several major banks contacted for comment declined to discuss the specifics of their ATM maintenance protocols or vendor agreements.

Consumer advocates have called for clearer disclosure requirements. "Most people assume their bank is the only party with access to that machine," said one privacy attorney not affiliated with the report. "That is not always the case."

The report does not allege that any institution has actively harvested fingerprint data. It argues instead that the absence of explicit prohibition, combined with limited regulatory oversight of ATM service vendors, creates conditions worth examining.

Federal regulators have not commented on the report. The findings have not been peer reviewed.