{"id":101066,"date":"2025-01-08T11:26:18","date_gmt":"2025-01-08T11:26:18","guid":{"rendered":"https:\/\/veridas.com\/?p=101066"},"modified":"2025-08-11T06:29:51","modified_gmt":"2025-08-11T06:29:51","slug":"impact-assessment-and-biometric-data","status":"publish","type":"post","link":"https:\/\/veridas.com\/en\/impact-assessment-and-biometric-data\/","title":{"rendered":"Impact Assessment and Biometric Data Protection: How to Overcome Legal Barriers in Digital Identity Projects"},"content":{"rendered":"

Last update: august 2025<\/em><\/p>\n

Why Biometrics Raise Legal Concerns (And Why They Shouldn’t)<\/h2>\n

Many digital onboarding projects using biometrics face the same roadblock: legal concerns. Arguments like \u201cthis involves biometric data, so it\u2019s not legal\u201d halt implementations that were already technically and commercially validated.<\/p>\n

But in reality, using facial biometrics<\/a> with consent and safeguards is lawful both in Europe and in Spain.<\/strong> European regulations are clear: biometrics are permitted as long as appropriate guarantees are upheld. To move forward with confidence, it\u2019s crucial to rely on a Data Protection Impact Assessment (DPIA)<\/strong>: a structured tool to analyze risks, define necessary measures, and legally justify the processing according to GDPR.<\/p>\n

Why a Photo of the National ID (or Other Authentication Methods) Isn\u2019t Enough<\/h2>\n

In remote processes, simply presenting an image of an ID doesn\u2019t ensure the person presenting it is the rightful owner. The same applies to possession-based (like a token) or knowledge-based methods (like a password). They can all be easily shared, stolen, or used by third parties.<\/p>\n

What makes the difference is the inherence factor\u2014who you are. Biometrics introduce this level of verification with technical and legal guarantees that no other method can match. The National Cryptologic Center (CCN)<\/strong> highlighted<\/a> that Renewable Biometric References (RBRs)<\/a> \u201cmake forgery more difficult compared to other authentication methods,\u201d providing an \u201cadditional layer of security.\u201d<\/p>\n

The Spanish Data Protection Agency (AEPD)<\/strong> has also recently emphasized<\/a> that \u201cbiometric processing enables more reliable verification of who accesses protected spaces, preventing identity false\u2011pretences and unauthorized access.\u201d<\/p>\n

Moreover, many fraud cases arise due to manipulation or falsification of the document itself. Therefore, the most secure and effective approach is not to choose one method over another, but to combine them: document verification<\/a> + biometrics with liveness proof<\/a>. This multilayered approach better addresses fraud and aligns with the highest data protection and identity standards.<\/p>\n

Is Biometric Authentication Legal in Onboarding or Age Verification?<\/h2>\n

Yes. The General Data Protection Regulation (GDPR)<\/strong> allows the processing of biometric data if the user\u2019s explicit consent is obtained and all regulatory requirements are met. In Spain, Organic Law 3\/2018<\/a> confirms that consent is a valid legal basis for such processing.<\/p>\n

The European Artificial Intelligence Regulation (AI Act)<\/a>, approved in July 2024, classifies biometric systems requiring active user participation (like a selfie with liveness) as \u201clow or no risk.\u201d<\/p>\n

\"\"<\/p>\n

The Critical Role of a Data Protection Impact Assessment (DPIA)<\/h2>\n

A DPIA is a legal obligation when sensitive data\u2014such as biometric data\u2014is processed (Article\u202f35 of the GDPR). But rather than being a barrier, it\u2019s a strategic tool that enables legal justification and project progress.<\/p>\n

Without biometrics, an organization cannot be certain who is on the other side of the screen. The national ID card alone is easily impersonable\u2014it can be stolen, tampered with, or used by minors. Biometrics introduce the inherence factor, assuring real identity and shielding organizations from severe risks like identity fraud and regulatory penalties, particularly in regulated sectors such as banking, insurance, online gambling, or e-commerce.<\/p>\n

A strong DPIA enables you to:<\/p>\n

    \n
  • \n

    Evaluate and demonstrate the necessity of biometric processing versus other alternatives.<\/p>\n<\/li>\n

  • \n

    Ensure proportionality and legitimacy.<\/p>\n<\/li>\n

  • \n

    Identify potential risks during processing.<\/p>\n<\/li>\n

  • \n

    Document technical and organizational measures applied to mitigate those risks.<\/p>\n<\/li>\n

  • \n

    Provide evidence for audits, legal departments, or data protection authorities.<\/p>\n<\/li>\n<\/ul>\n

    Elements a Complete DPIA Should Include<\/h2>\n

    A robust Data Protection Impact Assessment doesn\u2019t have to be an obstacle.<\/strong> Instead, it serves as a structured guide so that legal teams can identify real risks, apply appropriate guarantees, and document compliance effectively. It should clearly cover seven essential aspects:<\/p>\n

      \n
    1. \n

      What processing will be conducted and why.<\/p>\n<\/li>\n

    2. \n

      What risks may exist and how they will be mitigated.<\/p>\n<\/li>\n

    3. \n

      Why the processing is necessary and proportionate compared to other options.<\/p>\n<\/li>\n

    4. \n

      What legal basis supports it (e.g., consent or public interest).<\/p>\n<\/li>\n

    5. \n

      How GDPR principles are complied with (minimization, purpose limitation, transparency, etc.).<\/p>\n<\/li>\n

    6. \n

      What security measures are applied (technical and organizational).<\/p>\n<\/li>\n

    7. \n

      Evidence to demonstrate compliance and risk management.<\/p>\n<\/li>\n<\/ol>\n

      Veridas assists data controllers by providing technical and functional details of the solution and implemented security measures, making it easier to address each point without added complexity.<\/p>\n

      Evolving Technologies, Reduced Risks: The Value of Privacy by Design<\/h2>\n

      Legacy biometric technologies had significant limitations in terms of reversibility, revocability, and effective data control. These limitations shaped cautious legal and regulatory attitudes.<\/p>\n

      Nowadays, those risks can be addressed with technologies developed from the ground up to meet privacy and security-by-default principles. Renewable Biometric References (RBRs)<\/strong> enable a more granular, secure, and controlled approach to processing. Their architecture includes features like non\u2011interoperability, regeneration upon suspicion of compromise, and an inability to reconstruct the original physical trait<\/strong>.<\/p>\n

      Not all biometric processing has the same impact or demands identical protective measures. The system\u2019s proportionality must be assessed based on its specific purpose, the measures in place, and the absence of less intrusive alternatives of equal effectiveness. This is precisely where a DPIA becomes a vital tool.<\/p>\n

      A strong DPIA not only demonstrates the necessity and lawfulness of processing but also transparently reflects technological improvements over previous options, along with the technical and organizational guarantees implemented. This level of detail is critical for obtaining a favorable evaluation from legal teams or regulatory authorities.<\/p>\n

      In highly sensitive contexts, such as protecting critical infrastructure or controlling access to restricted areas, the ability to justify, compare, and document biometric processing becomes even more significant. The Spanish Data Protection Agency (AEPD) has acknowledged this in its assessment of a biometric authentication system for secure facilities. It points out that well\u2011designed technologies can be more proportionate and less intrusive\u2014if they\u2019re properly argued in the DPIA and supported by privacy-by-design measures.<\/p>\n

      Technological evolution not only mitigates risks: it also provides data controllers with tools to assert compliance through proactive responsibility.<\/p>\n

      RBRs: Biometric Technology That Complies by Design<\/h2>\n

      Veridas has developed authentication technology based on Renewable Biometric References (RBRs), conceived in alignment with the GDPR and the AI Act:<\/p>\n

        \n
      • \n

        Irreversible:<\/strong> cannot be used to reconstruct the face.<\/p>\n<\/li>\n

      • \n

        Revocable:<\/strong> can be regenerated if compromised.<\/p>\n<\/li>\n

      • \n

        Non\u2011interoperable:<\/strong> only works in the system where generated.<\/p>\n<\/li>\n

      • \n

        Multiple:<\/strong> allow generating a unique reference for each use.<\/p>\n<\/li>\n<\/ul>\n

        These features are recognized by the National Cryptologic Center as key for security and privacy.<\/p>\n