A method of confirming the identity of a user includes processing biometric credentials, generating a user configurable policy including identities of a plurality of authenticating entities, storing the user configurable policy in a device, presenting the device to an authenticating entity at an authentication station, and requesting biometric and personal data of the user from the device data. The biometric data corresponds to at least one biometric feature desired for authenticating the user and the requesting operation is performed by a workstation of the authenticating entity. Moreover, the method includes consulting the user configurable policy in response to the requesting operation to determine whether the requested biometric data is permitted to be released from the device data, and releasing the requested biometric and personal data from the device data to the authenticating entity when the default rule associated with the one authenticating entity permits releasing the requested biometric and personal data.