Yoti will remove its Digital ID app from Apple’s App Store and Google Play in Spain on September 10 as it continues a court challenge against the Spanish Data Protection Agency.
The company is appealing an AEPD enforcement decision through Spain’s Audiencia Nacional. The case resulted in a 950,000-euro fine concerning the app’s biometric data processing.
Yoti says it considered changes that would keep the app available in Spain but concluded that its understanding of the regulator’s decision would require a non-biometric authentication option. The company argues that using a PIN, password, SMS code or email code would provide less protection for the identity documents and personal information stored in an account.
The app uses facial authentication when a user adds an identity document, recovers an account on a lost or new phone, deletes an account or changes a PIN. Businesses can accept the Digital ID for identity and age checks, including age verification for alcohol sales.
Yoti’s legal position distinguishes between the app’s account-security biometrics and the choice offered when a third party asks someone to present a Digital ID. The company says organizations using its credentials must provide a non-biometric route so that presenting the Yoti app remains voluntary.
Existing users in Spain can continue using the version already installed on their devices. They can also delete an account from within the app, while users who keep it are being advised to store a recovery file in case they need to regain access.
Yoti says its privacy controls prevent the company from deleting accounts on behalf of Spanish users. Account holders must perform that action themselves from the app.
The removal will pause new downloads and updates through the Spanish app stores. It does not shut down accounts already held by Spanish users or prevent the installed version from presenting identity and age credentials to services that continue accepting it.
Yoti says it hopes to republish the app after the appeal concludes and legal requirements for its authentication model are clarified.
The dispute turns on the treatment of retained facial templates as special-category data under Article 9 of the GDPR and the conditions under which consent to that processing is considered freely given.
Source: Yoti
–
By the ID Tech Editorial Team
