How is biometric data used to generate encryption keys?
We do not know how to extract a cryptographically secure key $K\in\{0,1\}^k$ for traditional symmetric encryption from biometric data $b$ such as fingerprints, by way of a function $F(b)\mapsto K$. As noted in the question, problem is that when the biometric data is re-acquired, the naturally occurring $b'$ will be slightly different from $b$ and we'll have $F(b)\ne F(b')$ unacceptably often, for about uniform $K$ of cryptographic interest (e.g. $k\ge80$ bits). That's including if how $F$ operates (e.g. minutiae extraction) is carefully tailored to the characteristics of the biometric data [#].

Allowing $F(b')$ used for decryption to generate several guesses of $K$ (with the right one sorted out thanks to authenticated encryption) does not seem enough to get a workable system.

What does work is extracting a secure sketch as $S(b)\mapsto s$ so that


for naturally occurring variations $b'$ of $b$, with high likelihood, the same key $K\in\{0,1\}^k$ can be extracted from $(b,s)$ and $(b',s)$ (and some public nonce $n$ if we want multiple $K$), using a function $F(b,s)$ or $F(b,s,n)$
$s$ can be published without compromising the confidentiality of $K$ or/and $b$; including if $s'=S(b')$ gets published for several naturally occurring variations $b'$ of $b$.


A search for articles on secure sketch returns a lot of bibliography.

However the interest of biometric data as encryption key is dubious: biometric data, in particular fingerprint, is hard to keep secret, which is the primary attribute desired for an encryption key. Using fingerprints as a means of identification makes much more sense.



[#] Note: all claims to the contrary that I met fall into at least one of these pitfalls:


the error rate is unacceptable, like for >5% of a population, an attempt to obtain the same $K$ a day after fails, even will allowance of two retries;
some ancillary data (similar to $s$ above) is required along $K$ or stored in the scanning device (thus in the later case the number of users is limited, replacement of a failed single scanning device cause disruption, and multiple scanning devices must communicate in order to produce the same $K$);
$K$ has very low entropy (say &lt;40 bits), making it vulnerable to better-than-brute-force key search, and even conceivable that two users accidentally end up with the same $K$ if nothing but their biometrics is an input;
some part of the method must remain secret, and is how the previous issue is masked.