The AEPD has relaxed its criteria regarding the use of biometric data in remote identification processes
The AEPD has published its response to a consultation on the use of a 1:1 biometric facial verification system for the remote identification of customers. The Agency classifies this as being of high strategic importance, as it anticipates some of the criteria it is expected to set out in its forthcoming guidance on biometric processing. It provides a particularly relevant perspective on the assessments of necessity and proportionality, the existing alternatives and the validity of consent as a basis for lawfulness. It also analyses one of the main challenges of using biometric technologies from the perspective of the GDPR: the relationship between the freedom to give consent and the assessment of necessity required in such cases.
The consultation stems from an organisation’s plan to implement a 1:1 biometric facial verification system as part of its remote customer onboarding process. Until then, identification had been carried out using identity documents, video recordings and visual checks performed by specialist staff. As the organisation intended to base the processing on the explicit consent of the data subjects, it raised questions with the AEPD regarding the validity of that consent, the need to offer non-biometric alternatives, and how to assess the tests of necessity and proportionality.
The prohibition and the three assessments that must be met
The AEPD’s analysis is structured around the lifting of the prohibition in Article 9(1) of the GDPR and the assessments of suitability, necessity and proportionality.
Lifting of the prohibition (Article 9(1) of the GDPR): the AEPD accepts explicit consent as a basis for lifting the prohibition on processing biometric data, provided that it can be given freely. In the context of identity verification, it considers it necessary that, alongside the in-person option, non-biometric remote alternatives be offered, such as electronic identification mechanisms recognised by the legal system.
The Agency distinguishes between the assessment of the freedom of consent and that of the necessity of the processing. An alternative to biometrics may be sufficient for the data subject to freely refuse biometric processing, without necessarily achieving an equivalent level of effectiveness for the intended purpose. From the perspective of consent, it must be analysed whether the data subject has a genuine alternative that preserves their freedom of choice. From the perspective of necessity, it must be assessed whether there is a less intrusive measure capable of reasonably achieving the same purpose with comparable effectiveness.
Suitability test: biometrics must be suitable for achieving the intended purpose. Although this is not the most contentious aspect, the AEPD considers that the system meets this first level of scrutiny. It considers that the technology is suitable for remotely verifying customers’ identities and helping to prevent document fraud and identity theft. One-to-one facial verification is an appropriate measure for checking that the person carrying out the process is who they claim to be.
Assessment of necessity: the mere existence of an alternative does not preclude the use of biometrics. The AEPD focuses its analysis on this point and points out that the comparison between alternatives must be made from a functional perspective. The fact that a measure is less intrusive is a relevant factor, but not sufficient in itself. To challenge the necessity of biometric processing, the alternative must achieve the same purpose with an equivalent level of effectiveness. The Agency’s considerations are as follows:
- The necessity test requires a comparison of the available measures in the light of the intended purpose and the specific risks that the data controller seeks to mitigate.
- Alternative procedures – whether in-person or remote, and non-biometric – are a relevant element of the analysis, but do not in themselves determine its outcome.
- The assessment must take into account the effectiveness of each measure in relation to the risks identified by the data controller.
- It is the data controller’s responsibility to justify, using objective evidence and in accordance with the principle of proactive accountability, why the proposed solution adequately addresses the identified need.
The Agency thus frames the analysis as a comparison of the practical effectiveness of the alternatives, rather than as a check to see whether a less intrusive measure exists.
Proportionality assessment: explicit consent and freedom of choice. The AEPD assesses, taken together, the intended purpose, the expected benefits and the safeguards put in place to limit the impact on data subjects’ rights. It emphasises that:
- The processing pursues a legitimate purpose, linked to the remote verification of customers’ identity and the prevention of fraud.
- Explicit consent may constitute a valid legal basis for the processing of biometric data, both for the purposes of Article 6(1)(a) and Article 9(2)(a) of the GDPR.
- The freedom to give consent requires that the data subject be offered non-biometric alternatives enabling them to access the service without being obliged to use the biometric solution.
These alternatives do not necessarily have to be equivalent in terms of speed, convenience or user experience. What matters is that they allow for a genuine choice and that the data subject does not suffer disproportionate consequences for opting for a different method. In this specific case, the AEPD considers it necessary that, alongside biometric identification, non-biometric in-person and remote alternatives be offered, using legally recognised electronic identification mechanisms.
Conclusions: the consultation provides relevant criteria for assessing the lawfulness of biometric processing. It confirms that the mere existence of less intrusive alternatives does not automatically preclude the use of biometrics, and that the analysis must take into account the actual effectiveness of the measures, the intended purpose and the risks sought to be mitigated. It also draws a clear distinction between the assessment of the necessity of the processing and the evaluation of the freedom of consent.
Whilst not constituting a general authorisation for the use of biometric technologies, the ruling appears to reflect a more flexible approach than that of previous criteria, particularly by expressly acknowledging that explicit consent may be a valid legal basis. It is therefore particularly advisable for organisations intending to implement this type of solution to seek specialist advice to enable them to assess their compliance with Articles 6 and 9 of the GDPR and to document their adherence to the principles of necessity, proportionality and proactive accountability.