FB pixel

EU watchdog rules airport biometrics must be passenger-controlled to comply with GDPR

EU watchdog rules airport biometrics must be passenger-controlled to comply with GDPR

The use of facial recognition to streamline air passenger’s travel journeys only complies with Europe’s data protection regulations in certain circumstances, the European Data Protection Board has ruled.

The EDPB issued the ruling in response to a request from the French Supervisory Authority to issue an opinion on whether biometric authentication by airlines or airports complies with the EU’s General Data Protection Regulation.

In its “Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR,” the EDPB finds that

Article 5 of GDPR covers principles for processing personal data. Clause (e) limits data storage, while clause (f) relates to integrity and confidentiality. Article 25 addresses “data protection by design and default,” and article 32 deals with security of processing.

The EDPB considered four scenarios for biometric passenger processing. One involves the biometric template being stored on an end-users’ device, and controlled by them. Second is a model of centralized template storage in which the data is encrypted, and the key held by the end user. Third, centralized storage of encrypted biometric data with the key in the hands of the airport operator. The fourth scenario is the same as the third, only with the data stored in the cloud.

The EDPB says both the third and fourth scenarios “cannot be compatible with Article 25 GDPR. Also, such processing would not comply with the principle of integrity and confidentiality under Article 5(1)(f) and Article 32 GDPR” unless further measures are taken.

The fourth scenario would also fail to comply with GDPR article 5(1)(e).

The digital travel credentials (DTCs) being piloted with EU Commission backing would avoid the violations by following the model of the first scenario considered by the EDPB.

In the meantime, airport biometrics continue to roll out across Europe, with Spain introducing facial recognition scanners in an example from earlier this year.

Related Posts

Article Topics

 |   |   |   |   |   | 

Latest Biometrics News


EU AI Act should revise its risk-based approach: Report

Another voice has joined the chorus criticizing the European Union’s Artificial Intelligence Act, this time arguing that important provisions of…


Swiss e-ID resists rushing trust infrastructure

Switzerland is debating on how to proceed with the technical implementation of its national digital identity as the 2026 deadline…


Former Jumio exec joins digital ID web 3.0 project

Move over Worldcoin, there’s a new kid on the block vying for the attention of the digital identity industry and…


DHS audit urges upgrade of biometric vetting for noncitizens and asylum seekers

A recent audit by the DHS Office of Inspector General (OIG) has called for the Department of Homeland Security (DHS)…


Researchers spotlight Russia’s opaque facial recognition surveillance system

In recent years, Russia has been attracting attention for its use of facial recognition surveillance to track down protestors, opposition…


Estonia digital identity wallet app from Cybernetica lifts off

Tallinn-based Cybernetica has submitted the minimum viable product (MVP) for Estonia’s national digital identity wallet to the Estonian Information System…


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Read This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events