FB pixel

EU watchdog rules airport biometrics must be passenger-controlled to comply with GDPR

EU watchdog rules airport biometrics must be passenger-controlled to comply with GDPR
 

The use of facial recognition to streamline air passenger’s travel journeys only complies with Europe’s data protection regulations in certain circumstances, the European Data Protection Board has ruled.

The EDPB issued the ruling in response to a request from the French Supervisory Authority to issue an opinion on whether biometric authentication by airlines or airports complies with the EU’s General Data Protection Regulation.

In its “Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR,” the EDPB finds that

Article 5 of GDPR covers principles for processing personal data. Clause (e) limits data storage, while clause (f) relates to integrity and confidentiality. Article 25 addresses “data protection by design and default,” and article 32 deals with security of processing.

The EDPB considered four scenarios for biometric passenger processing. One involves the biometric template being stored on an end-users’ device, and controlled by them. Second is a model of centralized template storage in which the data is encrypted, and the key held by the end user. Third, centralized storage of encrypted biometric data with the key in the hands of the airport operator. The fourth scenario is the same as the third, only with the data stored in the cloud.

The EDPB says both the third and fourth scenarios “cannot be compatible with Article 25 GDPR. Also, such processing would not comply with the principle of integrity and confidentiality under Article 5(1)(f) and Article 32 GDPR” unless further measures are taken.

The fourth scenario would also fail to comply with GDPR article 5(1)(e).

The digital travel credentials (DTCs) being piloted with EU Commission backing would avoid the violations by following the model of the first scenario considered by the EDPB.

In the meantime, airport biometrics continue to roll out across Europe, with Spain introducing facial recognition scanners in an example from earlier this year.

Related Posts

Article Topics

 |   |   |   |   |   | 

Latest Biometrics News

 

Biometrics providers and systems evolve or get left behind

Biometrics are allowing people to prove who they are, speeding journeys through airports, and enabling anonymous online proof of age,…

 

Findynet funding development of six digital wallet solutions

Finnish public-private cooperative Findynet has announced it will award 60,000 euros (US$69,200) to six digital wallet vendors to help translate…

 

Patchwork of age check, online safety legislation grows across US

As the U.S. waits for the Supreme Court’s opinion on the Texas case of Paxton v. Free Speech Coalition, which…

 

AVPA laud findings from age assurance tech trial

The Age Verification Providers Association (AVPA), and several of its members, have welcomed the publication of preliminary findings from the…

 

Sri Lanka to launch govt API policies and guidelines

Sri Lanka’s government, in the wake of its digital economy drive, is gearing up to release application programming interface (API)…

 

Netherlands’ asylum seeker ID cards from Idemia use vertical ICAO format

The Netherlands will introduce new identity documents for asylum seekers Idemia Smart Identity, compliant with the ICAO specification for vertical…

Comments

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Biometric Market Analysis

Most Viewed This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events