Spain’s data protection agency has told a financial firm that a one-to-one facial verification step for remote customer onboarding passes the GDPR tests of suitability, necessity and proportionality as designed, finding that the existence of a less intrusive alternative does not on its own make biometrics unnecessary.
The Agencia Española de Protección de Datos (AEPD) was answering a query about replacing a visual check. Under the firm’s existing process, a customer supplies an image of an identity document and a video, and back-office staff compare the two by eye, which the firm said relied too heavily on human judgment and could not stop online fraud. The proposed system would generate temporary biometric references from the document and video and compare them automatically. It would not search other databases or store the data, and would destroy the references after the comparison.
The agency said such one-off verification, with ephemeral data and no database, carries substantially less risk than permanent identification. An alternative displaces biometrics only if it is equally effective against fraud, and the comparison turns on how well each measure mitigates specific risks such as impersonation, document tampering and image alteration. Because human review could not offer the same reliability against those risks, the agency considered the necessity test met. In October the agency told a municipal council that facial recognition in a planned police video system must stay switched off unless its necessity was first justified.
The response does not amount to a general authorization or a technical certification. The firm must keep to the conditions it described and revisit its assessment if they change. Organizations must document the need they are addressing, the reliability required and why they ruled out alternatives, and must adjust if the expected gains fail to appear or an equally effective, less intrusive option emerges. Yoti pulled its Digital ID app from Spanish stores in September while appealing a 950,000-euro AEPD fine over the app’s biometric processing.
The agency also addressed consent, which can serve as a legal basis if it is explicit, free, specific and informed. Customers must be able to refuse biometrics without losing access to the service or facing negative consequences. The other route need not match biometrics for convenience or speed, the agency said, as long as it is practicable and imposes no disproportionate burden or cost. It cited qualified electronic signatures and Spain’s electronic ID card as examples.
Sources: Confilegal, El Confidencial Digital
–
By the ID Tech Editorial Team
