EDPB Issues Opinion on Facial Recognition at Airports

On 24 May 2024, the European Data Protection Board (EDPB) published an Opinion on the use of facial recognition technology by airport operators and airlines to streamline passenger flows. This Opinion, requested by the French Data Protection Authority, aims to ensure that such practices comply with GDPR requirements across EU Member States.

The Opinion assesses compatibility with Articles 5(1)(e) and (f), 25, and 32 of the GDPR. It excludes analysis of other provisions, such as the lawfulness of processing under Articles 6, 7, and 9.

Risk of Biometric Data

Facial recognition involves processing sensitive biometric data, posing risks like false negatives, bias, discrimination, and identity fraud. The EDPB emphasizes the need for less intrusive alternatives.

Scenarios of Storage Solutions

1. Individual Storage: Biometric data stored only on the individual’s device.
2. Centralized Storage with Individual Control: Data stored centrally but encrypted, with keys held by individuals.
3. Centralized Storage at Airport: Data stored within airport systems.
4. Cloud Storage: Data stored in the cloud, under airline control.

Findings and Recommendations

• Preferred Storage Solutions: The EDPB finds that only solutions where biometric data is stored by the individual or centrally encrypted with individual control are compliant with data protection principles.
• Excessive Data Processing: Where no legal requirement exists for identity verification, using biometrics for this purpose is excessive and non-compliant with the GDPR.
• Data Protection by Design: The Opinion underscores the importance of integrating data protection from the outset, ensuring measures are in place to protect individuals’ privacy.
• EDPB’s Position: The EDPB calls for a balance between effective airport operations and protecting individuals’ biometric data, highlighting the need for robust data protection measures in evolving technological landscapes.