{"id":45289,"date":"2023-01-10T17:10:45","date_gmt":"2023-01-10T17:10:45","guid":{"rendered":"https:\/\/veridas.com\/?p=45289"},"modified":"2024-04-10T09:22:38","modified_gmt":"2024-04-10T09:22:38","slug":"data-protection-impact-assessment-voice-biometrics","status":"publish","type":"post","link":"https:\/\/veridas.com\/en\/data-protection-impact-assessment-voice-biometrics\/","title":{"rendered":"Veridas voice biometrics passes Data Protection Impact Assessment (DPIA)"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In recent weeks, the prestigious firm ARPA Lawyers Consultants, with more than 30 years of experience in legal, economic, tax, and consulting advice, on behalf of Veridas, has completed a Data Protection Impact Assessment (DPIA) for our voice biometrics solution.\u00a0<\/span><\/p>

The results obtained have been as expected, having passed the DPIA, confirming that the solution as such is secure and allows the processing of voice biometric data with full guarantees.<\/span><\/p>

This, while limited in scope (more on why later), is nonetheless a tool that provides value, utility, and security for our customers and us. Any company wishing to implement biometric solutions, in this case, voice biometrics, and therefore needing to pass a Data Protection Impact Assessment, will have much of the work done if they choose a leading voice biometrics solution such as Veridas.\u00a0\u00a0<\/span><\/p>

This assessment is part of Veridas’ explicit and ongoing commitment to data protection, rigorous compliance, transparency, and auditability. Our solutions are private by design and default; this is another example.\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t

What is a Data Protection Impact Assessment (DPIA)?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

A Data Protection Impact Assessment is an essential tool to <\/span>certify compliance with Data Protection regulations<\/span><\/a>. In the European Union, it is defined in Articles 35 and following the <\/span>General Data Protection Regulation<\/span><\/a> (GDPR) and complemented by some of its Recitals, as well as by state-level regulations such as the Spanish <\/span>Organic Law on Data Protection and Guarantee of Digital Rights <\/span><\/a>(LOPDGDD).\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t

What is the difference between an Impact Assessment and a Risk Analysis?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

An Impact Assessment should not be confused with a Risk Analysis. As a matter of principle, before starting any activity involving the processing of personal data, it will be necessary to carry out what is known as a Risk Analysis, which, in short, involves a specific study of the measures to be applied to guarantee, within the limits of state of the art, maximum data security.\u00a0<\/span><\/p>

In contrast, the Data Protection Impact Assessment involves a more in-depth analysis of the security conditions that make up a processing operation or set of personal data processing operations and the degree of compliance with the applicable regulations. It even becomes mandatory when processing may generate a high risk to personal data.\u00a0<\/span><\/p>

In practice, Risk Analysis is always necessary and will, in turn, be a part of the study that requires a Data Protection Impact Assessment when it is carried out.\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t

Veridas' Impact Assessment for its Voice Biometric Authentication Solution<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In the case of Veridas, the Risk Analysis it carried out for its solutions showed that, according to the criteria established by the <\/span>Spanish Data Protection Agency <\/span><\/a>(AEPD), the use of the solution does not necessarily imply a high risk to the rights of individuals, so in this case, it was not necessary to carry out a DPIA. In any case, each Data Controller must analyze, before implementing the processing, whether the use of this solution in its specific use case requires or not carry out an Impact Assessment.<\/span><\/p>

At Veridas, we decided to carry out a DPIA for <\/span>our voice biometrics solution<\/span><\/a> voluntarily, with the conviction that it is appropriate to provide it with more transparency. This decision has been part of the company’s commitment to <\/span>be at the forefront of the reliability and transparency<\/span><\/a> of all its biometric solutions.\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In this Data Protection Impact Assessment, we have analyzed the degree of compliance of our voice biometrics solution with Data Protection regulations, and from which we derive several conclusions:\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

The importance of context in order to determine the scope<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

First of all, our voice biometrics solution is a solution designed to be integrated into a third-party system, so the scope of the Impact Assessment we have performed is, in itself, limited. In other words, in real-use situations, the solution will be part of a more extensive system, with the controls, security measures, and procedures determined by our customers. Therefore, as mentioned above, the specific use case will determine whether or not a Data Protection Impact Assessment is necessary to analyze the entire system.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Veridas as a data processor and not a controller<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

On the other hand, it is also important to remember that Veridas acts as a Data Processor by providing its services and licensing its solutions. This implies that, in relation to the aforementioned, if a specific treatment of a client requires, due to its characteristics, the performance of a PIA, the obligation would correspond to the client as Data Controller. In this sense, the Data Protection Impact Assessment carried out by Veridas may support its performance, but given its limited scope, it cannot replace a full Impact Assessment.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\"Calculate<\/a><\/span>