Yoti withdrawing ID app from Spain to avoid undermining biometric security

Can a person be identified from any measurement of a physical characteristic?

Spanish data protection regulatory AEPD has interpreted the EU’s General Data Protection Rule’s (GDPR’s) definition of “biometrics” in a way that may foreclose the possibility of having high assurance for use cases that are supposed to require it. Under GDPR, biometric data used for unique identification qualifies as “special category” data. Does facial age estimation count? No person is known to have ever been identified from FAE data alone, but AEPD says it does.

Yoti is withdrawing from the country pending the result of an ongoing appeal of a 950,000 Euro (roughly US$1.1 million) fine levied by the AEPD in the Audiencia Nacional (Spanish High Court). The fine a penalty for violating GDPR in its handling of biometric data.

As of September 10, the Yoti ID app will no longer be available in the Apple and Android app stores.

The AEPD’s position is that a non-biometric authentication alternative must be offered to make user consent valid. Yoti’s position is that the alternatives on offer, like PINs, passwords and SMS or email OTPs “can be easily shared, stolen or compromised.” Consumer choice, it says, is in the decision to use its app or not. Forced to chose between an insecure version of its digital ID app and a market exit, the company has chosen to leave the country.

The Age Verification Provider’s Association (AVPA) has warned that the AEPD’s position implies that EU Digital Identity (EUDI) Wallets will not be able to fulfill their purpose.

And Yoti argues that “(t)here are no credible, cost-effective alternatives to biometric authentication that offer equivalent high security, assurance and customer convenience.”

The regulator has argued that “privacy-based self-exclusion” represents an unacceptable threat to inclusion. The AEPD has not addressed risk of a slippery slope in which the uninformed decisions of a small minority determine the rule for everyone.

Yoti hopes to return to the app stores in Spain following a high court decision. The company recommends users in Spain who with to continue using the app store a recovery file in case of any issues updating to a future version of the app if and when it is republished in their region.

Article Topics

AEPD  |  biometrics  |  data protection  |  face biometrics  |  facial age estimation (FAE)  |  GDPR  |  mobile app  |  Spain  |  Yoti  |  Yoti ID Checker