Biometrics has advanced as a field to the extent that matching selfies and detecting simplistic spoofs are largely considered solved problems, yet fraud rates continue to rise.

The new frontier in identity protection, where injection attacks delivering deepfakes and fakes made with generative AI are pitted against the most sophisticated liveness detection and document validation technologies.

A couple of large American technology providers are testing the limits of public tolerance of video surveillance in everyday life, while EU and the MOSIP stakeholders consider the finer details of implementing population-scale digital identity systems.

Fighting fakes

Biometric injection attacks have become the wild frontier of identity security, Chris Allgrove of Ingenium Biometric Laboratories explained in an EAB lunch talk this week. Injection attack detection technologies and standards-based IAD testing are still maturing, but will have to grow up fast to deal with the fraud threat deepfakes already pose.

The proliferation of deepfakes and fraudulent content are a growing concern as America prepares for elections later this year. Even hyper-local campaigns to reduce voter turnout could impact results, and Reality Defender’s Ben Colman tells Biometric Update we should expect more deepfakes with each election.

FaceTec’s Jay Meier expounds on the importance of biometric liveness detection to the digital wallet infrastructure projects currently underway in the Biometric Update podcast. Government, businesses and people are asking digital wallets to do a lot for them, they need to be able to trust who is controlling them.

Entrust is working on upgrading the accuracy of its face biometrics, and hails the progress shown in its latest results in the NIST FRTE. The new version of Entrust’s Onfido algorithm showed dramatic improvement across several different one-to-one matching scenarios.

A team from Idemia Public Security including prominent authentication and cryptography expert Teresa Wu has been granted a patent for a visible digital seal technology. The cryptographic graphic would be printed onto a document to enable its authentication.

India-based identity verification provider IDfy raised $52 million to expand its operations, including into international markets. The company plans to strengthen its TrustStack digital onboarding and risk mitigation platform, and acquisitions may be ahead, too.

DHS

An RFI from the U.S Department of Homeland Security and accompanying documents show the extent of plans to modernize, consolidate and scale its biometric matching infrastructure. DHS seeks a single software platform to handle requests from CBP, ICE, the TSA, USCIS, the Secret Service and its headquarters.

The results of the latest phase of the Remote Identity Validation Rally held by DHS S&T and the MdTF are in, and they aren’t pretty. RIVR phase two covers identity document validation, with the seven vendors chosen as state-of-the-art ranging from qualified success to abysmal failure.

The paperwork for U.S. Customs and Border Protection’s integration of Clearview AI’s facial recognition leaves unknown at this time whether the required privacy analysis has been completed yet. Depending  on the details of Clearview’s work with CBP, either a Privacy Threshold Analysis or an independent assessment of the company’s security and privacy controls for security authorization is required.

Surveillance statements

U.S. privacy group EPIC has asked the FTC to investigate Meta’s “smart glasses” and their native facial recognition capability, which it hoped to sneak by civil society while it’s backs were turned. The biometric wearables were also kicked out of court and nominated as a costly liability risk.

Ring’s ambitions of a network combining residential surveillance with license plate tracking through a partnership with Flock may be on ice, but the Search Party’s just getting started. Leaked internal communications suggest the company has hopes of using the opt-out feature to “zero out crime in neighborhoods.”

Making digital identity work

The ambition and technology behind the EU’s Digital Identity Wallets are sound, Signicat VP of Digital Identity and Regulation Jon Ølnes writes in a guest post for Biometric Update. But EUDI Wallets will fail, partially or completely, if four distinct risks are not addressed.

Practical lessons learned during brownfield implementations of MOSIP have started to roll in, with Uganda’s migration complete and Sierra Leone in progress. MOSIP Connect 2026 provided a forum for those insights to be shared as Nigeria advances with the largest brownfield implementation yet.

As lawmakers race to avert a government shutdown ahead of the January 30 funding deadline, negotiators have released the FY 2026 Homeland Security Appropriations Act agreement text, quietly cementing biometrics as one of the most structurally embedded and politically sensitive technology pillars inside the Department of Homeland Security (DHS).

Spread across DHS components and funding mechanisms, biometric identity systems now sit at the center of immigration enforcement, border processing, aviation security, and identity vetting, with Congress using appropriations language not only to fund these systems, but also to impose guardrails on how they may be modernized, shared, or reorganized.

The bill text, published as part of the joint explanatory statement accompanying the consolidated appropriations package, reflects a striking dual posture.

On the one hand, Congress continues to pour billions of dollars into biometric infrastructure, advanced identity verification, and AI-enabled screening tools. And on the other hand, lawmakers repeatedly signal concern that poorly planned reorganizations, opaque data-sharing practices, or mission creep could weaken accountability, civil liberties protections, and operational continuity.

Nowhere is that tension more evident than in Congress’s treatment of the DHS Office of Biometric Identity Management, or OBIM, which operates the department’s core biometric systems, including the Automated Biometric Identification System (IDENT) and its successor, the Homeland Advanced Recognition Technology (HART) platform.

The agreement provides $271 million for OBIM in FY 2026, underscoring its continued centrality to DHS operations. At the same time, lawmakers included explicit language warning against any abrupt transfer or restructuring of biometric authorities without detailed planning and congressional notification.

Under the agreement, DHS may not move biometric identity functions out of OBIM or substantially reorganize them without first submitting a detailed plan demonstrating that any transfer would be seamless, preserve mission effectiveness, and maintain oversight, privacy, and civil liberties protections.

The language reflects growing congressional unease with proposals floated within the executive branch to consolidate or realign biometric authorities, particularly if such changes could dilute accountability or fragment control over some of the federal government’s most sensitive identity systems.

The bill also continues targeted investment in modernizing DHS’s biometric backbone. Within the Management Directorate’s Procurement, Construction, and Improvements account, the agreement includes $25 million specifically to support continued development of HART.

That funding reinforces Congress’s intent to see the long-delayed replacement for IDENT move forward, even as lawmakers remain cautious about expanding HART’s role without stronger oversight mechanisms in place. Congress’ civil liberties concerns are especially pronounced in provisions governing how biometric data may be used in high-stakes immigration and family separation contexts.

The agreement requires DHS to notify the Office of Inspector General and the Office for Civil Rights and Civil Liberties within 24 hours if biometric information from HART or foreign biometric intelligence sharing is used to separate a minor child from a parent or legal guardian, subject to limited exceptions.

The unusually direct reporting mandate reflects sustained scrutiny of DHS’ use of biometric data in enforcement decisions involving families.

At the Transportation Security Administration (TSA), Congress continues to back biometric identity verification as a core element of aviation security, while layering in new oversight expectations. The agreement provides $10.6 billion for TSA Operations and Support, alongside $330.2 million for procurement, construction, and improvements and $24 million for research and development.

Within those totals, lawmakers allocate $15 million for Credential Authentication Technology (CAT) systems used at airport checkpoints, $300 million for checkpoint screening modernization, and $12 million for research into AI-enhanced screening technologies.

CAT systems are designed to validate the authenticity of identity documents and interface with Secure Flight and other backend systems, forming the technical foundation upon which biometric matching can be layered.

TSA is also directed to continue piloting biometric identity verification technologies at checkpoints, but only with robust privacy safeguards in place and with a required report to Congress within 180 days of enactment that details data use, retention practices, and impact to civil liberties.

The bill’s language makes clear that biometric expansion in aviation security is no longer viewed as experimental or peripheral. Instead, Congress treats biometric identity verification as a permanent feature of TSA operations, while simultaneously signaling that unchecked deployment without transparency or public accountability will not be tolerated.

Customs and Border Protection’s (CBP) biometric programs receive similarly sustained backing, particularly those tied to entry-exit tracking and traveler identity verification. The CBP fee-funded programs table explicitly lists the 9-11 Response and Biometric Exit Account, placing biometric exit alongside passenger inspection and agriculture inspection fees as a standing operational cost.

The continued reliance on fee-funded mechanisms underscores how deeply biometric exit has been integrated into CBP’s core mission, even as full nationwide deployment has faced persistent operational and infrastructure challenges documented by DHS oversight bodies.

Despite its central role in CBP’s biometric exit strategy, the 9-11 Response and Biometric Exit Account has long been a source of structural friction rather than a stable foundation for nationwide deployment. The account is funded through passenger fees rather than direct appropriations, tying biometric exit operations to fluctuations in air travel volume and airline compliance.

Oversight bodies have repeatedly found that this funding model complicates long-term planning, limits CBP’s ability to scale infrastructure consistently across airports, and leaves biometric exit deployments unevenly distributed.

Rather than supporting a uniform national system, the fee-funded structure has contributed to a patchwork of deployments that vary by airport, airline participation, and available technology, undermining the goal of comprehensive exit tracking.

Operational challenges compound these funding constraints. A Government Accountability Office audit and DHS Inspector General review found that while CBP’s biometric exit systems generally perform well under controlled conditions, real-world deployment at boarding gates has struggled to meet program performance targets.

Photo capture rates during departures have fallen short of CBP’s stated goals, reflecting the reality that biometric exit relies on coordination among airlines, airport authorities, and CBP systems that do not operate under unified control.

Congestion, staffing constraints, airline boarding practices, and inconsistent technology integration all affect capture rates, creating gaps in exit data even at airports where biometric systems are nominally deployed.

These limitations help explain why Congress continues to fund biometric exit while simultaneously signaling caution, embedding the program within fee-funded accounts and requiring ongoing reporting rather than mandating rapid or universal expansion.

Congress also directs the U.S. Citizenship and Immigration Services (USCIS), in coordination with CBP, to submit a report within 180 days assessing the feasibility and cost of collecting biometrics at certain CBP-controlled locations. The requirement highlights lawmakers’ interest in tighter integration across DHS components, while stopping short of mandating new collection regimes without further analysis.

Taken together, the FY 2026 DHS funding agreement reflects a clear congressional judgment: biometric systems are now indispensable to DHS operations, but they are also among the department’s most politically sensitive and legally fraught technologies. Rather than retreating from biometrics, lawmakers are doubling down on investment while tightening expectations around governance, transparency, and continuity.

That posture aligns with broader congressional skepticism toward sweeping internal reorganizations of biometric authorities. As Biometric Update reported last summer, proposals to shift or consolidate DHS biometric functions raised alarms.

The FY 2026 agreement does not prohibit reorganization outright, but it makes clear that Congress intends to be consulted - and convinced - before any changes are made.

In effect, the bill treats DHS biometrics as critical national infrastructure. Funding flows continue, modernization is encouraged, and new capabilities are authorized. But Congress is also drawing firmer lines around who controls these systems, how they may be used, and what protections must accompany their expansion.

As biometric identity becomes increasingly foundational to border security, immigration enforcement, and domestic travel, lawmakers appear determined to ensure that technological momentum is sustained, but that it also does not outrun democratic oversight.

On Friday, Congresswoman Yvette D. Clarke of New York’s 9th Congressional District galvanized bipartisan concern about the Department of Homeland Security’s (DHS) proposed rule to dramatically expand biometric data collection in immigration and naturalization procedures.

Clarke and 49 members of the House wrote to DHS Secretary Kristi Noem and U.S. Citizenship and Immigration Services Director Joseph Edlow urging the agency to withdraw or substantially revise the proposal.

The lawmakers outlined deep reservations about the breadth, lack of safeguards, and civil rights implications of what DHS wants to do, arguing that it risked undermining public trust and essential protections for millions of individuals affected by U.S. immigration law.

“The proposed rule raises serious questions about privacy, data security, and the potential for discriminatory or unauthorized surveillance,” the lawmakers wrote, adding that “without significant changes, this proposed rule will potentially damage American citizens’ and children’s privacy and risk unauthorized disclosure of their fingerprints, eye scans, and DNA.”

The rule in question, published in November as an advance notice of proposed rulemaking by DHS, seeks to overhaul longstanding limits on biometric data collection.

Under current regulations, DHS collects fingerprints, photographs, and other identifying information in specific immigration contexts, primarily to verify identity and conduct security checks.

The new rule would remove age restrictions and expand the collection and use of biometric identifiers for a far broader group, including individuals merely associated with immigration benefit requests, irrespective of whether they are U.S. citizens, nationals, or lawful permanent residents.

“The rule would allow DHS to require biometric submissions from anyone associated with an immigration benefit request – including U.S. citizens, children, and lawful permanent residents serving as petitioners, sponsors, beneficiaries, or dependents – with no age limitations and broad permission to store, share, and reuse this data,” the lawmakers’ letter says.

The noted that these “biometric identifiers are permanent and cannot be changed if compromised, making the risks of misuse or breach uniquely severe, irreversible, and lifelong.”

Proposed biometric modalities would extend beyond fingerprints and facial imagery to include additional traits such as ocular scans, voice prints, and potentially DNA or DNA test results, with continuous vetting envisioned throughout an individual’s stay until citizenship is achieved.

Public comments on the rule are open through early January, at which point DHS will review feedback before finalizing any changes.

In their letter, the lawmakers raised a series of pointed concerns about how the rule as drafted failed to safeguard civil rights, privacy, and cybersecurity. They pointed to reporting highlighting DHS’s increasing reliance on facial recognition and third-party data systems that, critics say, lack sufficient transparency or oversight.

Those reporting efforts, the lawmakers argued, reveal disproportionate impacts on communities of color and immigrant populations and underscore the dangers of expanding surveillance infrastructure without clear guardrails.

The letter also referenced recent high-profile breaches of biometric systems - including hacks of databases tied to companies used by foreign law enforcement and unauthorized access to U.S. Customs and Border Protection data from facial recognition pilot programs - as evidence of the risks posed by broad biometric collection absent robust protections.

Central to the legislators’ critique was the absence in the proposed rule of detailed mechanisms to ensure adequate protection of collected data.

The letter argues that DHS’s proposal lacks meaningful information on how expansive biometric datasets would be secured against cyber threats, how long data would be retained, who could access the information, how independent auditing would function, or how transparency would be provided to individuals whose biometric information is stored and used.

Without such safeguards, the lawmakers warn, public trust in immigration administration could erode, and civil rights protections which are foundational to fair and humane governance could be jeopardized.

The letter framed biometric technologies not merely as technical tools but as systems with profound implications for privacy, equality, and societal trust.

The lawmakers urged DHS to adopt a framework that genuinely protects individuals - both U.S. citizens and noncitizens - rather than exposing them to “unnecessary and unmitigated risk.”

They stressed that biometric data collection and reuse must be constrained by clear civil liberties protections, transparent oversight, and rigorous cybersecurity measures if it is to be justified in the context of immigration and naturalization.

Broader debates over DHS’s use of biometric and surveillance technologies have been intensifying as federal agencies increasingly integrate digital identification and data analytics into security and immigration operations.

Civil liberties advocates and some policy scholars argue that expansive biometric systems can create chilling effects on privacy and freedom of expression, especially for marginalized and immigrant communities, and that the federal government’s analysis of such proposals often underestimates the societal costs involved.

Critics also contend that such systems may deter lawful immigration by imposing onerous requirements and could contribute to heightened surveillance of U.S. citizens through their associations with immigrants.

These concerns resonate with the points raised by Clarke and her colleagues in their critique of the current DHS proposal.

As DHS evaluates public comments on the proposed rule, the conversation among lawmakers, privacy advocates, and immigrant rights groups is likely to continue focusing on how to balance the agency’s stated objectives - identity verification, national security, and administrative efficiency - with robust protections for individual rights.

Biometrics hold stunning potential for establishing trust and enabling inclusion for people living outside of bureaucratic systems, but these goals can clash. A possible solution for national ID systems emerges from some of the week’s top articles on Biometric Update.

The role of the post office in an era of digital government may be delivering trust, in the form of biometric binding for digital credentials. Governments and online platforms around the world are running up huge trust deficits, but perhaps one of the more reliable public institutions, possibly rebranded as the “trust office,” can provide some of the basic assurances necessary.

Feedzai’s impressive funding round shows the confidence investors have in the latest fraud prevention technologies once people are interacting with digital financial services.

Public opinion divide

The UK government’s mandatory digital ID plan has left digital identity providers certified under the DIATF wondering if they have wasted effort and money only to be undercut. PM Kier Starmer’s proposal aligns with suggestions from former Labour PM Tony Blair’s eponymous institute, which counts an American Big Tech mogul among its major doners, and is facing immediate resistance in Ireland and Scotland. DSIT has promised a consultation, but offered little detail on the plan so far.

Switzerland is also divided over digital ID, with 50.4 percent approving a government plan in a national referendum. The narrow margin laid bare a lack of trust that the government will have to address as it rolls out the optional digital ID and Swiyu digital wallet. The result does represent 14 percent more support than the Swiss national digital ID had in 2021, though, providing some hope for its proponents.

People are right to be skeptical of digital IDs, says Andy Higgs of DINZ, but the group sees New Zealand as ready for decentralized identities in the form of mobile driver’s licenses, which could be launched by the end of 2025. Open standards for digital wallets, ZKPs and the Biometric Processing Privacy Code all contribute to that readiness.

Countries around the world are looking for a range of benefits from their digital ID, from the immigration reduction intentions of the UK to the economic boost Sri Lanka is hoping for by enabling its fintech sector. Most of these goals require a tricky combination of robust biometric enrollment and identity binding and inclusive availability. One institution that has long trafficked in trust and accessibility is the post office.

A new purpose for a venerable institution?

In the UK, the Post Office is already a digital ID provider, through a partnership with Yoti, but a new paper from the organization says it can do more. The paper says the removal of Biometric Residence Card collection and other services has hurt its bottom line, but it could be made sustainable again if designated the in-person contact point for the digital ID system for interactions like biometrics enrollment.

Poste Italiane is already Italy’s top provider of digital ID services, and it has provoked some criticism from the public with the announcement of plans to start charging fees for them. Competitors Aruba and InfoCert are already charging for SPID services though, and Post Italiane serves around half of the country’s digital ID users.

A new report from eu-LISA on digital travel identity management emphasizes the need for continuous research and investment in technology. The report delves into the potential of blockchain for people claiming asylum, and the challenge of remote biometrics enrollment.

America’s border biometrics

Bi2 has won a contract with ICE worth up to $4.6 million to supply iris biometrics for enforcement field operations. ICE will use the MORIS mobile front-end system and the IRIS back-end to match subjects against millions of arrest records.

The golden work visa scheme put in place by U.S. President Donald Trump could dramatically cut a source of funding to DHS for the biometric entry-exit system. But the collections have disappointed so far anyway, and funding specifically allocated to biometrics spiked with the allocation of $165 billion for the department earlier this year.

CBP’s biometric exit is continuing to evolve, quietly adding scans with mobile devices carried by federal officers to the cameras installed at boarding gates by airlines, following an extensive testing process. Little is known about the mobile devices used, however, fueling suspicions about government surveillance.

Startup and scale-up

Handwave CEO Janis Sturna discuss the potential of hashed palm biometrics for a range of applications including payments, loyalty programs and age assurance in the latest episode of the Biometric Update Podcast. He explains the combination of characteristics his company uses, and its U.S. expansion plans.

Feedzai has raised $75 million at a $2 billion valuation, and plans to scale its fraud protection business and developing technology for its comprehensive platform. The company also signed a potentially lucrative agreement with the ECB to support the digital euro.

In recent years, the deployment of biometric technologies—particularly facial recognition—has accelerated across public and private sectors worldwide. Airports have been among the most prominent adopters of these systems, driven by promises of improved security, streamlined passenger processing, and operational efficiencies. However, the rapid integration of such technologies has raised significant legal, ethical, and technical concerns surrounding privacy, data protection, algorithmic fairness, and transparency.

One notable recent development is the decision by the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, abbreviated GPDP) to suspend the operation of FaceBoarding’s facial recognition service at the automated border control gates of Milan Linate Airport. This essay examines the background, the technology involved, the GPDP’s rationale and legal basis, the implications for stakeholders (including passengers, airport operators, airlines, and technology providers), and the broader context of biometric governance in Europe.

Background: FaceBoarding and Automated Border Control

FaceBoarding is a provider of biometric identity-verification solutions that uses facial recognition to authenticate travelers at automated border control (ABC) gates. The technology matches a live image or video of a passenger’s face captured at the gate against a stored reference image—typically from a passport or a governmental identity database—to verify identity and allow passage without human border officer intervention. Proponents argue that such systems can speed up processing, reduce queues, and maintain or enhance security by cross-checking identities against watchlists or risk indicators.

Milan Linate Airport, one of Italy’s principal domestic and regional airports, implemented FaceBoarding’s solution to streamline passenger throughput at automated border gates. The system was intended to allow authorized travelers to be verified biometrically as they moved through passport control, ostensibly improving the passenger experience and operational performance.

The GPDP’s Decision: Suspension and Its Basis

The Italian Data Protection Authority issued an order to suspend the FaceBoarding facial recognition service at Milan Linate Airport. The GPDP’s decision reflects concerns about compliance with Italy’s data protection framework and the EU General Data Protection Regulation (GDPR). While the specific case details and official reasoning are multi-faceted, the GPDP’s intervention typically rests on several central legal and factual points that are commonly invoked when authorities scrutinize biometric systems:

• Lawfulness of processing: Under the GDPR, biometric data uniquely identifying a person is a category of “special categories of personal data” (sensitive data). Processing such data requires a robust legal basis and, often, explicit legal authorization. The GPDP must be satisfied that the airport and FaceBoarding had a lawful basis to collect and process biometric data for identity verification.

• Proportionality and necessity: Data processing must be necessary and proportionate to the stated objective. The Authority likely examined whether less intrusive means could achieve the same aims (e.g., manual checks, non-biometric identity verification) and whether the biometric approach was proportionate given the privacy risks.

• Transparency and informed consent: Individuals must be appropriately informed about biometric data processing and their rights. The GPDP often scrutinizes whether passengers received clear, intelligible information and whether any consent obtained was freely given and specific—particularly significant if refusal would effectively prevent a passenger from traveling or impose undue inconvenience.

• Data minimization and storage limitation: The GDPR requires that collected data be adequate, relevant, and limited to what is necessary, and stored only as long as necessary. The GPDP likely reviewed the types and quantity of images captured, how long data were retained, whether templates or raw images were stored, and whether retention policies were justified and implemented.

• Security and data protection measures: The Authority examines whether appropriate technical and organizational measures were in place to protect biometric data from unauthorized access, breaches, or misuse. This includes encryption, access controls, secure transmission, and contractual safeguards between involved parties.

• Data subject rights and redress: Effective mechanisms must exist for passengers to exercise their rights (access, rectification, erasure, objection) and to obtain meaningful redress. The GPDP may have found that the procedures for enabling such rights were insufficient or unclear.

• Risk assessment and DPIA: The GDPR requires a Data Protection Impact Assessment (DPIA) for high-risk processing, such as large-scale biometric identification. The GPDP would assess whether a DPIA was properly conducted, whether risks were identified and mitigated, and whether supervisory authority consultation occurred when residual risks remained high.

Although the GPDP suspended the service rather than ordering a permanent ban, suspension indicates serious concerns and a need for corrective measures before processing can resume lawfully.

Legal and Regulatory Context

Understanding the GPDP’s action requires situating it within the broader Italian and European legal framework.

• GDPR: The European Union’s GDPR provides the primary legal regime for personal data protection across member states. Biometric data used for uniquely identifying a person is treated as special category data under Article 9 and is subject to stricter conditions. Processing of such data is generally prohibited unless specific safeguards and legal bases are present (e.g., explicit consent, substantial public interest under Union or Member State law, or specific provisions for identification and security).

• Italian Data Protection Code: Italy’s national legislation supplements GDPR requirements and contains provisions relevant to public security, border control, and the processing of identity and biometric data. Where national laws create legal bases for biometric processing in certain public interest contexts (e.g., border control under migration and security laws), the compatibility of such national rules with GDPR’s principles remains critical.

• EEA jurisprudence and Guidelines: The European Data Protection Board (EDPB) and national courts issue guidance and rulings affecting biometric systems. Recent years have seen heightened scrutiny: some European supervisory authorities have launched investigations into airport facial recognition systems; others have required rigorous DPIAs or imposed limitations. Court decisions in the EU have also reinforced strict standards for processing biometric data and emphasized necessity, proportionality, and strong safeguards.

• Biometric Surveillance Landscape: The EU has proposed a regulatory framework for Artificial Intelligence (AI Act) that differentiates between high-risk and prohibited AI applications, with facial recognition for remote biometric identification in public spaces receiving special attention. Though the AI Act is at a different legislative stage, it signals a broader shift toward stricter governance of biometric technologies.

Practical Concerns and Technical Considerations

Beyond legal bases, the suspension likely reflects practical and technical shortcomings or uncertainties. Key concerns raised in similar cases include:

• Accuracy and bias: Facial recognition algorithms can exhibit variable accuracy across demographic groups, with documented higher false match or false non-match rates for women, older adults, and certain ethnicities. This can lead to wrongful denials, additional scrutiny, or unequal treatment.

• Function creep and secondary uses: Without strict controls, biometric data collected for border control could be repurposed for other uses (e.g., law enforcement, marketing), raising significant privacy risks. Supervisory authorities require limiting purposes and contractual/technical controls to prevent misuse.

• Data retention and storage architecture: Whether images are processed locally and immediately discarded, stored as templates, or transmitted to centralized databases affects risk profiles. The GPDP would scrutinize retention periods, whether raw images are stored, and who has access.

• Third-party processing and sub-processors: FaceBoarding, airport operators, airlines, and governmental agencies might all play roles. Processing agreements, data controller/processor roles, liability allocation, and cross-border data transfers must comply with GDPR rules.

• Consent vs. legitimate interest: In airports, obtaining freely given consent can be problematic because travelers may feel compelled to comply. Many operators rely on other legal bases—such as performance of a contract or public interest—but such bases must be carefully justified, especially for biometric data.

• Operational transparency and signage: Visible notices, clear opt-out options, and accessible information help meet transparency obligations. The GPDP likely evaluated whether passengers were adequately informed at points of entry, booking, and gate areas.

Implications for Stakeholders

The GPDP’s suspension affects multiple stakeholders and has broader implications for biometric use in transportation and public spaces.

• For passengers: The immediate effect is that biometric processing at the suspended gates cannot be used, protecting travelers’ biometric privacy until compliance is demonstrated. It may also mean a return to manual passport checks with potential impacts on wait times.

• For airport operators and airlines: The suspension highlights operational and compliance risks inherent in deploying biometric systems. Operators may need to invest in stronger data protection practices, re-evaluate procurement and contractual terms, and consider alternative solutions while ensuring traveler experience and security are maintained.

• For technology providers (e.g., FaceBoarding): Providers must demonstrate compliance through improved technical safeguards, transparent data flows, clearer documentation of lawful bases, and robust DPIAs. The incident may prompt redesigns, additional certifications, or changes to data handling architectures.

• For regulators and policymakers: The decision underscores the need for clear, harmonized rules and guidance on biometric technologies. Regulators may increase scrutiny of similar deployments elsewhere and push for stronger industry standards.

• For public trust: High-profile suspensions raise public awareness about privacy risks and can erode trust in biometric systems. Transparent remedial steps and accountable governance are necessary to restore confidence.

Possible Remedial Actions and Path to Compliance

To address the GPDP’s concerns and enable lawful resumption of operations, stakeholders could take several concrete steps:

• Conduct or update a comprehensive DPIA that fully documents risks, identifies mitigations, and demonstrates that any residual risks are proportionate and justified. Where high residual risk remains, consult the supervisory authority as required by GDPR.

• Clarify and document the lawful basis for processing biometric data. If relying on consent, ensure it is explicit, freely given, and granular; if relying on public interest or other bases, ensure adequate legal authorization and justification exists under national law.

• Implement strict data minimization: process only what is necessary (e.g., ephemeral templates instead of raw images), limit retention to the minimum necessary, and delete data promptly after verification.

• Enhance technical security measures: robust encryption, pseudonymization, access controls, audit logging, and secure transmission/storage architecture.

• Strengthen governance and contracts: clear data processing agreements, limits on sub-processing, and roles and responsibilities defined among operators, technology providers, and public authorities.

• Provide clear passenger information and opt-out mechanisms: visible signage, pre-travel communication, and easy alternatives to biometric processing without penalty.

• Conduct independent testing and bias audits to demonstrate algorithmic fairness and accuracy across diverse populations, and publish results or summaries to enhance transparency.

• Establish redress mechanisms and clear processes for passengers to exercise data subject rights.

Broader Significance and Lessons Learned

The GPDP’s suspension at Milan Linate is emblematic of a broader recalibration across Europe regarding biometric technologies—particularly in sensitive applications like border control. Several lessons can be drawn:

• Regulatory authorities will enforce GDPR protections for biometric data and are prepared to intervene where legal requirements are not met.

• Deployments in public, high-traffic contexts require anticipatory governance: robust DPIAs, stakeholder engagement, clear legal bases, and stringent technical safeguards.

• Technology vendors and adopters must prioritize privacy by design and by default, emphasizing minimization, transparency, and accountability from the outset.

• Public acceptance hinges on trust; transparency, demonstrable fairness, and effective safeguards are essential to secure social license for biometric systems.

• Harmonized standards and clearer legal frameworks at the EU level—or explicit national legislation where permitted—could reduce uncertainty and improve compliance while ensuring fundamental rights are protected.

Conclusion

The suspension of FaceBoarding’s facial recognition service at Milan Linate Airport by the Italian Data Protection Authority underscores the tension between technological innovation and fundamental rights protections. While biometrics offers clear benefits for efficiency and security in border operations, it also raises acute privacy, fairness, and governance challenges. The GPDP’s action reflects the stringent requirements of the GDPR for processing special categories of data and highlights the necessity for rigorous legal justification, technical safeguards, transparency, and accountability.

Moving forward, successful and lawful deployment of facial recognition at airports will require collaborative efforts among technology providers, airport authorities, airlines, regulators, and civil society to ensure systems are necessary, proportionate, non-discriminatory, and respectful of travelers’ rights. The Milan Linate case serves as a cautionary example and an opportunity: to refine practices, reinforce protections, and develop governance frameworks that enable useful innovation while safeguarding individual liberties.

[addtoany]