EDPB provides input on biometric use in airports

 The French Supervisory Authority has sought the European Data Protection Board's opinion on the use of facial recognition technology by airport operators and airline companies for biometric authentication of passengers, with the objective of enhancing passenger flow at airports. The Board underscores that the use of biometric data, particularly facial recognition technology, poses significant risks to the rights and freedoms of individuals. This data type is given special protection under Article 9 of the GDPR. Prior to implementing such technologies, controllers are strongly advised to thoroughly evaluate the impact on individuals' fundamental rights and freedoms, and to consider if less invasive methods can achieve the intended purpose. The focus of this opinion is on the compatibility of the processing with specific articles of the GDPR, with the aim of streamlining passenger flow at airports at security checkpoints, baggage drop-off, boarding, and access to passenger lounges. This opinion does not provide a complete analysis of the GDPR compliance by the relevant controllers in each case, and it does not address the validity of consent for such processing.


Additionally, this opinion does not override any restrictions on using biometric data established by Member State law. The Board evaluates the processing for compliance with the GDPR provisions in four specific scenarios. In the first scenario, the 'biometric template ', which refers to a unique digital representation of an individual's biometric data, is stored on the individual's device and is under their sole control for passenger authentication at airport checkpoints. The Board concludes that the chosen measures are necessary if the controller can demonstrate that there are no less intrusive alternatives. The second scenario involves the centralized storage of an encrypted biometric template within the airport, with the key solely in the passenger's hands for authentication at airport checkpoints. The Board concludes that this processing is necessary if no less intrusive alternatives are available. However, the controllers should justify the retention period for storage limitation. The Board recommends that controllers consider the shortest possible storage period while allowing passengers to set their preferred storage period.

By: WCSF Team

Comments

Post a Comment

Popular posts from this blog

Revised OECD AI Principles Address Emerging Challenges

The OECD (Organization for Economic Cooperation and Development) recently updated its AI Principles to address the rapid development of AI, particularly general-purpose and generative AI. These updated principles ensure AI is used responsibly and ethically while promoting innovation and economic growth. Here's a summary of the key points : Focus on emerging challenges:  The revisions address privacy, intellectual property, safety, and information integrity in the context of new AI advancements. Global impact:   With 47 members, including the EU, the OECD AI Principles serve as a blueprint for international AI policy frameworks. The updated AI Principles: It strike a delicate balance between fostering innovation and  upholding  ethical standards, advocating  for  trustworthy AI that respects human rights and democratic values. Rapid AI development:  The OECD reports significant growth in AI investment, skills demand, and adoption by large firms. T...
Read more

Navigating the Cloud: Cybersecurity Risks and Best Practices

Cloud computing has revolutionized business operations with its scalability, flexibility, and cost efficiency. However, this transformative technology also introduces unique cybersecurity risks that businesses must proactively address to safeguard their valuable data and systems. Understanding Cloud Security Threats Data Breaches: Cloud environments, like any data storage, are vulnerable to breaches due to misconfigurations, application vulnerabilities, or compromised credentials. Unauthorized Access: Inadequate access controls can allow unauthorized individuals to access, modify, or delete sensitive data. Shared responsibility models can sometimes cause confusion about who is accountable for securing specific aspects of the cloud environment. Insecure APIs: Application Programming Interfaces (APIs), essential for cloud services, can become entry points for attackers to exploit vulnerabilities and access sensitive data if not properly secured. Misconfiguration: The complexity of cl...
Read more