Video identification and biometric data: checking identity without excess

Video identification can make contract onboarding faster. The GDPR assessment depends on the actual workflow: does a trained person inspect an identity document during a recorded conversation, or does software extract facial features and compare them for unique identification? The second model may involve biometric data.

This article addresses video identification during contract onboarding. It explains purpose, legal basis, transparency, alternatives, deletion and provider access. Video surveillance of business premises, ordinary identity checks and credit decisions have different purposes. The article on access rights to employee data is a separate resource for internal access organisation.

Video identification covers different processes. A trained person who checks an identity document during a conversation raises different questions from software that extracts facial features and compares them with a document image or reference image. The data flow, rather than the product label, determines the GDPR classification.

Article 4(14) GDPR defines biometric data as personal data resulting from specific technical processing relating to physical, physiological or behavioural characteristics that allow or confirm unique identification. Feature extraction can therefore bring a process within Article 9. Whether it does so must be clear from the provider documentation.

Before using the service, map the recording, live image, document, feature comparison, result, logging and deletion separately. A service marketed as a short identity check may still involve several processing steps. The glossary entry on special categories of personal data provides the related classification.

The purpose should be specific, for example checking whether the applicant is the person shown in the identity document. Later use for advertising, risk profiles or behavioural analysis does not automatically follow from that check. Purpose limitation requires a compatible use or a separate sound basis for any further purpose.

The concrete process must be assessed under Article 6 GDPR. If biometric data are involved, that is not enough. Article 9(1) expressly lists biometric data used for uniquely identifying a natural person as a special category. A suitable exception under Article 9(2) is also required. A general contract consent or a reference to fraud prevention does not answer that question by itself.

The record should connect purpose, data categories, legal bases, people affected, recipients and storage locations. The records of processing should show the actual steps. The page on privacy compliance and governance helps organise the documentation.

Before the check starts, people should understand what is recorded, which data come from the document and the face, who is involved and how long the information is kept. The notice should also explain whether an automated comparison occurs and what a positive or negative result means.

A person needs a realistic route through the onboarding process when video identification is unavailable or the person does not use it. Whether an alternative is required depends on the purpose and contract. A manual review can be a suitable option when it verifies identity with a lower level of intrusion.

Review the alternatives and their comparability before launch. Security, error rates, accessibility, duration and exceptional cases matter. A choice must work in practice. Article 25 GDPR requires privacy to be considered when the process is designed.

Data in a video-identification process serve different functions. The original recording may document the check, a biometric template may support comparison and a log may show what happened. They should not automatically receive the same retention period. Article 5(1)(e) GDPR requires storage to remain limited to what is necessary.

Set a deletion trigger for each data type. It may be completion or termination of onboarding, a specific statutory retention duty or the end of a defined purpose. A log should not contain unnecessary images or feature data. Deletion must include exports, test systems, backups and provider processes.

A deletion policy is reliable only when its operation is tested. Check whether the provider deletes data after the service, which backup copies remain and how a later data-subject request is handled. For international routes, see the article on standard contractual clauses and transfer impact assessments.

Many services are operated by specialist providers. Whether a provider is a processor or pursues its own purposes depends on actual decisions about purposes and means. Article 28 GDPR applies where the provider processes data on instructions. The contract label does not settle the roles.

Record subcontractors, storage locations, administrator access and support routes. If data are transferred to a third country, Articles 44 et seq. GDPR add further requirements. Check whether the provider uses video-identification data for training, quality assurance or its own risk models.

Article 32 GDPR requires security appropriate to the risk. Encryption, separate access roles, logging, secure transfer and an incident process are key measures. Sensitive images and feature data should be accessible only to the extent required for the purpose.

The product label replaces the process review: Only the actual data flow shows whether biometric features are processed.

The purpose expands: An identity check later becomes advertising, profiling or general risk scoring.

One general consent is used: Agreement to a contract does not automatically cover every processing of special categories.

Every data type gets the same period: Video, templates and logs need separate purpose and deletion decisions.

The provider remains a black box: Subcontractors, locations, transfers and independent uses are not documented.

Start with a process map from the beginning of the video session to deletion. Mark when a document is read, when a face is analysed, when a result is produced and when a person intervenes. Keep the identity result separate from image, feature and log data.

Then review purpose limitation, Articles 6 and, where relevant, 9 GDPR, the notice, alternative, provider role, third-country transfer and security. If the processing is likely to create a high risk, assess the need for a data protection impact assessment under Article 35 before launch. The glossary entry on data protection impact assessments gives a starting point.

Finally test deletion, maintain an access matrix and define a process for access, rectification, erasure and breaches. Record which changes trigger a new assessment. This keeps the identity check linked to contract onboarding.

We review the technical workflow, biometric-data classification, purpose and legal basis, transparency, alternatives, deletion, provider roles and possible third-country transfers. For a first assessment, provide the provider description, information notice, contract, deletion policy and a data-flow outline. Subscribe to legal updates for new articles and legal information from the firm.