Access control by biometric authentication during remote payment procedures

Purposes (3)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

1

Control and authentication of the debtor during payment procedures

Legitimate interest

Article 6(1)(f) UK GDPR - legitimate interest in securing remote payments and preventing identity fraud. Biometric data used to uniquely identify a customer is special category data: explicit consent (Article 9(2)(a)) is likely to be the most appropriate condition (ICO biometric recognition guidance). Customers who do not opt in should be offered another authentication method, as the FCA expects firms to provide several ways to complete strong customer authentication (Payment Services Regulations 2017, reg. 100).

2

Reinforce security measures to combat identity theft

Legitimate interest

Article 6(1)(f) UK GDPR - legitimate interest in securing remote payments and preventing identity fraud. Biometric data used to uniquely identify a customer is special category data: explicit consent (Article 9(2)(a)) is likely to be the most appropriate condition (ICO biometric recognition guidance). Customers who do not opt in should be offered another authentication method, as the FCA expects firms to provide several ways to complete strong customer authentication (Payment Services Regulations 2017, reg. 100).

3

Simplify the authentication of customers enabling them to access their remote banking services

Legitimate interest

Article 6(1)(f) UK GDPR - legitimate interest in securing remote payments and preventing identity fraud. Biometric data used to uniquely identify a customer is special category data: explicit consent (Article 9(2)(a)) is likely to be the most appropriate condition (ICO biometric recognition guidance). Customers who do not opt in should be offered another authentication method, as the FCA expects firms to provide several ways to complete strong customer authentication (Payment Services Regulations 2017, reg. 100).

Data categories (1)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Data collected from customers choosing to use facial authentication

Data details

transaction logs

required

Biometric facial modelrequiredsensitive data

Last name, first name, customer detailsrequired

Customer's online banking IDrequired

Data conservation rules

Active base:

No statutory period. Biometric templates are kept only while the customer uses facial authentication and are deleted when the customer withdraws consent, deactivates the feature or closes the account. Other authentication data (such as authentication logs) are kept for a period set by the controller based on fraud prevention and audit needs, in line with Article 5(1)(e) UK GDPR.

Destruction

Data subject (1)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Customers

GDPR Data processing modelAccess control by biometric authentication during remote payment procedures

Purposes (3)

Data categories (1)

Data collected from customers choosing to use facial authentication

Data subject (1)