Selfies and 1-to-1 face verification: when can they be used?
A selfie, a manual holder check and an automated biometric Face Match are different processing operations. This page explains the EU GDPR framework, how ID Scan performs remote holder verification, and the additional Dutch rules we have found for employment and Wwft client due diligence.
It is not a search in a facial database, not 1-to-many identification, and not continuous employee recognition or tracking.
Three operations that should not be confused
The legal assessment depends on what is actually done with a facial image. We therefore distinguish between capturing an image, a human comparison and an automated biometric comparison.
1. Capture or retain a selfie
A selfie is personal data. Whether it is processed as special-category biometric data depends on the specific technical processing and purpose. A facial image by itself is not the same processing operation as automated Face Match.
2. Manual holder check
An authorised person can visually compare the selfie or live image with the portrait from the verified identity document. In this route ID Scan does not perform the automated biometric Face Match.
3. Automated 1-to-1 Face Match
Software technically processes facial characteristics and compares two faces to confirm identity. The Dutch Data Protection Authority explicitly states that one-to-one identity confirmation is covered by the biometric rules.
Source: Dutch Data Protection Authority (AP) – Biometrics and one-to-one identity confirmation
EU / EEA: the GDPR starting point
Under Article 9 GDPR, biometric data used to uniquely identify or confirm the identity of a person are subject to the special-category data rules. Processing is prohibited unless an Article 9(2) exception applies. One possible exception is the data subject's explicit consent under Article 9(2)(a). Member States may also have more specific rules, including for employment.
Route supported by ID Scan: explicit consent
- The person is clearly informed that an automated biometric 1-to-1 comparison will take place.
- Consent relates specifically to that biometric holder verification.
- The person can decline the automated comparison.
- A manual holder-verification route can be offered instead.
Not a blanket conclusion for every EU country
The GDPR provides the common framework, but national law and supervisory-authority guidance may add requirements. This is particularly relevant in employment. The country, purpose and relationship with the person should therefore be assessed before enabling biometric verification.
Source: Regulation (EU) 2016/679 (GDPR), in particular Articles 9 and 88
Explicit consent must be a real choice
The AP identifies explicit consent as a possible exception for facial recognition. Consent must be freely given, specific, informed and explicit. This requires particular care where a person may feel dependent on the organisation, such as in an employment context. When relying on consent, a genuinely equivalent alternative is therefore important.
1-to-1 biometric holder verification
Where explicit consent is a valid Article 9 GDPR exception in the specific context, ID Scan can automatically compare the live person with the portrait from the identity document.
Manual holder verification
If the person does not consent to automated biometric comparison, an authorised person can manually compare the selfie or live image with the document portrait.
Source: AP – Legal framework for facial recognition: explicit consent and an equivalent alternative
In Case C-660/26 (International Card Services), the Court of Justice of the European Union has been asked whether recording and storing a photograph showing a person's face for identification can constitute biometric processing under Articles 4(14) and 9 GDPR, and under what conditions. The case is still pending. ID Scan therefore does not assume that every face photograph is automatically a biometric template; its automated Face Match, however, does technically process facial characteristics for 1-to-1 identity confirmation and is treated on this page as biometric processing.
EU Court of Justice – pending Case C-660/26, International Card Services
Remote holder verification: document + live person
An authentic identity document does not by itself prove that the person presenting it is the rightful holder. ID Scan therefore combines document verification with a separate holder check.
Where supported by the document, the reference portrait is read from DG2 in the secured NFC chip. The comparison therefore uses the portrait from the physical identity document rather than a separately uploaded reference image.
The app observes the face during capture and performs liveness-related checks. These controls are intended to make presentation of a static photo or other non-live input more difficult.
The live face is compared only with the portrait belonging to the identity document being verified. ID Scan does not search a population or customer facial database.
ID Scan also applies device-integrity controls and is designed to reject verification on devices that do not meet the required integrity conditions, including detected rooted or jailbroken environments.
Why not rely only on a video call?
A manual video call can be useful for remote identity checking, but digital video also has its own attack surface. Examples include replayed or pre-recorded video, virtual-camera software and manipulated or AI-generated video. These techniques are commonly discussed as presentation attacks, spoofing or, where synthetic media are involved, deepfakes.
ID Scan therefore does not rely solely on what a reviewer sees on a screen. The holder check can combine the physical NFC identity document and its chip portrait with live face capture, liveness-related checks, device-integrity controls and a one-to-one comparison.
These measures are intended to increase assurance and make manipulation more difficult. They do not make identity fraud impossible, and ID Scan does not claim that any technical method can exclude every form of spoofing or deepfake attack.
Privacy by design: limit the biometric processing
The purpose of Face Match is a one-time holder check, not building a facial-recognition database. ID Scan therefore limits the processing and reuse of biometric information.
1-to-1 only
The live face is compared only with the portrait belonging to the identity document being verified. There is no 1-to-many search.
On-device processing
Face detection, liveness-related processing and the biometric comparison are performed on the user's device. Face templates do not need to be sent to or retained in a central biometric database.
Result instead of reusable biometrics
The verification process can retain the outcome of the holder check without retaining a reusable facial template for future recognition.
The design goal is simple: answer “does this live person belong to this document?” without turning that check into a reusable facial identity system.
La AEPD ofrece un ejemplo concreto de este patrón de privacidad: la autenticación biométrica puede realizarse en el propio dispositivo móvil de la persona usuaria, sin recursos o servidores externos, comparando la fotografía recuperada de un documento oficial de identidad con un selfi en tiempo real para comprobar que la persona usuaria es titular del documento. La AEPD también destaca la disponibilidad de mecanismos alternativos.
Fuente: AEPD – autenticación biométrica en el propio dispositivo móvil
Netherlands: remote identity checks for employees
Dutch sources explicitly address the employer's holder check and remote digital identity verification.
The Dutch government states that an employer must verify a new employee's identity and must check, among other things, whether the photograph on the identity document corresponds with the person presenting it. This is why document authenticity and holder verification are separate questions.
The Dutch Tax Administration's Payroll Taxes Handbook states that an employer may establish an employee's identity digitally. It also states that both the identity document and the identity of the employee may be checked remotely and that this work may be outsourced to a third party. The employer remains responsible and must be able to demonstrate that sufficient care was taken.
In 2026, the District Court of Rotterdam held in a financial-supervision case that a passport copy alone was insufficient to verify a person's identity. The court noted that a copy lacks authenticity features, physical data can be altered relatively easily and any biometric data cannot be read. This does not amount to judicial approval of ID Scan, but it illustrates why ID Scan does not rely solely on an uploaded document image and, where possible, verifies the physical electronic document through its NFC chip.
District Court of Rotterdam 2026 – identity verification and passport copies
Example: remote onboarding through a staffing or HR platform
Consider a worker who registers remotely with a staffing agency through an HR platform. A genuine NFC identity document may still be used by someone other than its holder. Document verification therefore answers a different question from holder verification.
MRZ/CAN, NFC chip data and document-authenticity checks provide evidence about the document itself.
A 1-to-1 Face Match or a manual holder check addresses the risk that a genuine document is being presented by another person.
Our reading of the Dutch sources is that remote employee identity verification is expressly possible. Automated biometric holder verification remains a separate processing operation for which an applicable Article 9 GDPR exception is required. ID Scan supports explicit consent and a manual alternative; the customer remains responsible for determining the appropriate legal basis and procedure for its own use case.
Germany: biometrics in employment and remote identification
Germany applies the GDPR together with national rules, including §26 of the Federal Data Protection Act (BDSG), and has separate regulated frameworks for anti-money-laundering identification.
Employees and applicants: consent requires extra care
§26 BDSG specifically governs personal-data processing in employment and also covers applicants. Where employee data are processed on the basis of consent, the dependency inherent in the employment relationship and the circumstances in which consent is given must be taken into account when assessing whether that consent is freely given.
For special categories of personal data, including biometric data used to uniquely identify a person, consent must explicitly cover those data. German supervisory guidance also warns that employee consent will often not be a sufficient legal basis because the employment relationship can limit genuine freedom of choice.
ID Scan therefore does not make automated Face Match the only route. If the person does not consent to the automated biometric 1-to-1 comparison, the process can use a manual holder check instead. This supports genuine choice, but does not by itself determine the customer’s legal basis: the German use case must still be assessed on its own facts.
Privacy by design: no central reusable face template
ID Scan performs the biometric 1-to-1 comparison locally on the smartphone. The biometric face template is not sent to ID Scan’s servers or to the customer and is not retained in a central biometric database. The customer receives the verification result rather than a reusable biometric face profile. This does not remove the GDPR/BDSG assessment, but it materially limits storage, reuse and access risks.
German GwG: a separate regulated identification framework
For organisations subject to the German Money Laundering Act (GwG), it is not enough to conclude that a technical process appears to provide an equivalent security level. §13 GwG and BaFin guidance define a separate framework for permitted identification procedures. A biometric NFC-and-Face-Match flow should therefore not be presented as automatically approved for German GwG identification without checking the applicable regulatory route.
For Germany, the key distinction is therefore between general biometric holder verification under the GDPR/BDSG and identification performed within a specifically regulated framework such as the GwG. The appropriate legal basis and procedure depend on the purpose and context.
Belgium: employment biometrics and remote holder verification
Belgian guidance draws a sharp distinction between biometric processing in employment and remote identity verification under the anti-money-laundering framework.
Employees: do not assume consent solves the Article 9 issue
The Belgian Data Protection Authority (GBA/APD) takes a strict position on biometrics in the workplace. Because of the power imbalance between employer and employee, it states that explicit employee consent cannot normally be regarded as freely given in a work-related context. In its view, a specific legal basis will therefore almost always be required that clearly justifies proportionate biometric processing in that context.
Belgian employers do have legitimate reasons and obligations to identify employees, including social-security administration. That need to establish identity does not, by itself, create permission to use automated biometric Face Match. The legal basis for the identity process and the Article 9 exception for biometric processing must be assessed separately.
The Belgian authority states that, where biometric processing is justified, a biometric template should in principle remain under the control of the employee rather than being stored in a central employer database. ID Scan's architecture goes in that direction: the temporary face template and 1-to-1 comparison remain on the smartphone, no reusable biometric template is sent to ID Scan or the customer, and no central face database is created. This reduces storage and reuse risks, but does not itself create a legal basis.
Belgian AML: the National Bank explicitly identifies the holder-verification problem
For remote identification under the Belgian anti-money-laundering framework, the National Bank of Belgium (NBB) expressly notes that checking an electronic identity document remotely can be less reliable than face-to-face verification because there is no visual check establishing that the person using the document is its lawful holder.
Where there is no visual contact, the NBB expects the institution to be able to demonstrate that the required reliability has nevertheless been achieved or, where necessary, to apply an additional verification measure. The NBB also notes that comparing data stored on the chip with the visible document data can help detect falsification. This illustrates why document authenticity and holder verification are separate questions in a remote process.
For Belgium, the conclusion therefore depends strongly on context. Employee biometrics require particular caution under GBA/APD guidance. In the AML context, the NBB expressly recognises the remote holder-verification risk and the possible need for additional verification measures. Neither position should be read as a blanket approval of a particular Face Match implementation.
France: distinguish workplace biometrics from one-time remote identity proofing
French CNIL rules are strict for biometric access control at work, while regulated remote identity verification also has a separate ANSSI/PVID security framework.
Employment: the CNIL workplace rule has a specific scope
The CNIL's binding workplace-biometric regulation applies to biometric authentication used to control access to premises, work equipment and professional applications. It requires necessity and proportionality and notes that employee consent can only rarely serve as a legal basis because the employment relationship can affect genuine freedom of choice.
Importantly, the CNIL expressly states that this workplace regulation does not apply to biometric processing pursued for a different purpose. A one-time remote holder check during onboarding is therefore not automatically the same legal use case as a biometric door lock or access-control system. We have not found an official French source that turns this distinction into blanket permission for biometric employee onboarding, so the applicable Article 9 exception and necessity must still be assessed for the specific use case.
Within its workplace-access guidance, the CNIL says that an employer relying on consent must provide a genuinely equivalent alternative, such as a badge or password, without positive or negative consequences influencing the choice. ID Scan similarly offers a manual holder-verification route when automated Face Match is not used. This is a relevant safeguard, but it should not be read as a CNIL approval of employee-onboarding Face Match.
In 2017 and 2018, before the GDPR became applicable, the CNIL authorised Société Générale and Boursorama to use facial recognition for remote customer onboarding. These systems compared a live/selfie image with the portrait from the identity document to strengthen remote identity checks and reduce false or stolen-identity fraud. Both decisions required a non-biometric onboarding route; the CNIL considered a genuine alternative essential to the freedom of consent.
In the Boursorama flow, the selfie and document portrait were securely transmitted for server-side biometric comparison. The templates existed only in memory during the comparison and were then deleted together with the extracted portrait, selfie and comparison score; only the authentication result was retained. The CNIL highlighted data minimisation and non-retention of biometric templates as safeguards.
These historic authorisations are not blanket approvals under today's GDPR, but they are relevant precedents for the purpose and safeguards of one-time remote holder verification. ID Scan applies the same minimisation principle while going further on data locality: the biometric 1-to-1 comparison is performed locally on the smartphone and no reusable biometric face template is transmitted to ID Scan or the requesting organisation.
France has a formal framework for remote identity verification: PVID
France's cybersecurity authority ANSSI operates the PVID framework for remote identity-verification providers. ANSSI describes the purpose as the same as an in-person check: establish that the identity document presented by a natural person is authentic and that the person is the legitimate holder of that document.
The current PVID requirements include fraud-resistance measures and explicitly define liveness detection as checking that the user's facial video is live and has not been physically or digitally altered. PVID services can be certified at substantial or high assurance levels. This confirms the technical distinction used throughout this page: document authenticity and holder verification are separate parts of remote identity proofing.
French AML: regulated remote verification has specific routes
For organisations subject to French anti-money-laundering rules, the Code monétaire et financier provides specific identity-verification routes. Where the primary methods cannot be used, Article R.561-5-2 requires a combination of at least two listed measures and includes use of an ANSSI-certified remote identity-verification service at substantial assurance level. ACPR guidance also confirms that technologies such as biometrics and videoconferencing may be used only when the applicable regulatory requirements are met. ID Scan should therefore not be presented as automatically approved for French AML solely because it uses NFC, liveness and Face Match.
For France, context is decisive. The CNIL's binding workplace-biometric rules specifically target access control and should not simply be copied to one-time onboarding. At the same time, biometric onboarding still requires an applicable GDPR Article 9 exception. In regulated remote identity proofing, France has a mature ANSSI/PVID framework that explicitly combines document authenticity, legitimate-holder verification and liveness/fraud resistance.
Austria: biometric remote identification is explicitly regulated
Austrian rules provide concrete examples of regulated remote identity proofing using liveness, biometric holder comparison and, in the financial AML framework, electronic chip verification.
Photoident: live face and biometric comparison with the identity document
Austria's Identifikationsverordnung (IVO) contains a regulated Photoident procedure for remote transactions. The procedure requires automated steps, including capturing photographs or video of the person's face, checking that a living person is participating, examining the identity document and comparing the facial images with the photograph on the identity document using biometric methods.
This is a useful regulatory example of the distinction between checking a document and checking its holder: the remote process must establish both the identity evidence and whether the participating person corresponds with the portrait on that evidence.
Financial AML identification: NFC and cryptographic document authenticity
The Austrian Financial Market Authority (FMA) has allowed purely biometric remote customer identification under the Online-Identifikationsverordnung since 2021, subject to specific conditions. The FMA describes a process performed algorithmically without personal contact with an employee, with customer agreement, state-of-the-art technology, a security level comparable to staff-led identification and a liveness check.
For biometric identification, the current Online-IDV requires an official photo identity document whose content has been electronically signed by the issuing authority. The obliged entity must verify the authenticity of that electronic signature, the integrity of the signed data and that the signing key has not been compromised. The FMA explains that, from 1 January 2023, this document check is performed by reading the electronic security chip (NFC chip).
The Austrian framework addresses the same two technical questions that ID Scan separates: is the electronic identity document authentic, and is the person presenting it its holder? ID Scan checks the cryptographically protected NFC document where supported and then performs a one-time 1-to-1 holder comparison with liveness-related checks. This technical similarity does not mean that ID Scan is automatically approved or certified under the Austrian regulatory regimes.
These Austrian rules are specific regulated use cases, not a general permission to use Face Match for every purpose. Outside such a statutory framework, the organisation must still determine its own GDPR Article 6 basis and an applicable Article 9(2) exception for biometric processing, and assess necessity, proportionality and any national requirements.
España: se reconocen expresamente la verificación remota del titular y la biometría local 1:1
La normativa española y las orientaciones de la AEPD ofrecen ejemplos especialmente concretos de verificación documental, prueba de vida y comparación biométrica del titular en procesos de identidad remotos.
Identificación remota: autenticidad del documento, titular legítimo y prueba de vida
La Orden ETD/465/2021 regula la identificación remota por vídeo para la expedición de certificados electrónicos cualificados. El proceso debe verificar la autenticidad, vigencia e integridad del documento de identidad y comprobar que su titular corresponde con el solicitante, mediante tecnologías como el reconocimiento facial. También debe verificar que participa una persona viva y que no está siendo suplantada.
La Orden permite procesos asistidos y no asistidos, aunque los procesos no asistidos son revisados posteriormente por un operador. También exige consentimiento expreso para la grabación del vídeo y para el tratamiento y conservación de categorías especiales de datos, e informar al solicitante de alternativas de identificación que no requieran el tratamiento y conservación de su imagen y datos biométricos.
La Agencia Española de Protección de Datos (AEPD) describe la autenticación biométrica en el propio dispositivo como una posible forma de comprobar que la persona que recupera información de un documento oficial de identidad es su titular: la fotografía obtenida del documento se compara con un selfi en tiempo real en el propio dispositivo, sin recurrir a recursos o servidores externos. La AEPD subraya que también deben existir mecanismos alternativos.
Por qué es especialmente relevante para ID Scan
Este ejemplo de la AEPD se aproxima mucho a la arquitectura de privacidad de ID Scan: un retrato fiable del documento de identidad se compara 1:1 con un rostro en vivo en el teléfono, mientras la comparación biométrica permanece local. La similitud es técnicamente relevante, pero no constituye una aprobación de ID Scan ni crea una base jurídica general para el tratamiento biométrico.
España ofrece así un reconocimiento normativo sólido de la verificación remota del titular como concepto técnico legítimo. Esto no significa que el Face Match 1:1 sea automáticamente lícito para cualquier caso de uso en España. El responsable debe determinar la base aplicable del artículo 6, una excepción del artículo 9.2, la necesidad y proporcionalidad y cualquier requisito sectorial.
Italy: remote identity verification is recognised, with a clear distinction between manual and biometric checks
Italian supervisory material recognises remote onboarding and 1-to-1 biometric verification, while the legal basis and proportionality remain use-case dependent.
Manual face comparison is not automatically biometric processing
The Italian Garante has expressly distinguished an ordinary visual identity check from automated facial recognition. In a case concerning remote verification, the Garante stated that facial images become biometric processing for identity verification when the comparison is automated using dedicated software or hardware. A human comparison of ordinary photographs was not treated as biometric recognition in that case.
Remote onboarding: liveness and document-to-face matching
For financial-sector remote onboarding, Italy now applies the EBA remote-onboarding framework through Banca d'Italia. For unattended processes, the guidance requires checks that the customer is a live human being and effective, reliable algorithms to verify that photographs or video captured during the process correspond to the images obtained from the customer's official documents.
This is directly relevant to holder verification: remote document acquisition is only one part of the process; the remote process must also establish that the live person corresponds to the portrait associated with the claimed identity. Italy increasingly gives priority to eIDAS-compliant digital identities such as SPID and CIE in regulated AML onboarding, so Face Match should not be presented as the only or automatically preferred Italian AML route.
Before the GDPR became applicable, the Garante authorised InfoCert's remote webcam recognition process for issuing qualified or digital signatures. The applicant was informed about the processing of personal and biometric data for remote recognition; if the applicant did not accept that processing, an alternative identification method had to be offered. This historic decision is not a blanket authorisation under today's GDPR, but it is relevant to the recurring safeguard of providing a genuine non-biometric route.
Italy also distinguishes 1-to-1 verification from 1-to-many identification
The Garante's biometric guidance distinguishes biometric verification, where a biometric model is compared with the model linked to a claimed identity, from biometric identification, where a model is searched against all available models. The former is expressly described as a one-to-one comparison. This supports the technical distinction used on this page, but does not by itself provide a GDPR Article 9 legal basis.
For Italy, remote holder verification is a recognised technical concept and current financial-sector guidance expressly addresses liveness and document-to-face matching. At the same time, Italy does not provide a general exemption for 1-to-1 Face Match. The controller must still establish the applicable Article 6 basis, an Article 9(2) exception, necessity and proportionality, and any sector-specific requirements.
Portugal: biometric remote identity verification is used in the national digital identity ecosystem
Portuguese government and CNPD material show facial recognition, liveness and identity-document authenticity checks being used and scrutinised together.
Chave Móvel Digital: face, liveness and identity document
Portugal's Chave Móvel Digital can be activated remotely through the government digital-identity ecosystem using biometric facial verification. In its review of the legal framework, the Portuguese Data Protection Authority (CNPD) described deep-learning facial recognition, liveness detection and technology for verifying the authenticity of the Cartão de Cidadão as parts of the process.
The CNPD did not treat the use of biometrics as self-justifying. It called for the law to describe the processing and automated logic more precisely, identify the personal data involved, clarify responsibilities and retention periods, and provide enough information for citizens to make a free and informed choice.
Portugal therefore provides a useful combination: remote biometric holder verification is a real government use case, while the privacy regulator stresses transparency, purpose limitation, retention and genuine choice. ID Scan addresses several of those risk factors by keeping the 1-to-1 biometric comparison on the smartphone and not creating a reusable central facial template; that technical design does not itself create a legal basis.
Identity-document copies: verification does not automatically require retaining a copy
The CNPD also takes a restrictive approach to reproducing the Portuguese Citizen Card. Its public guidance explains that copying the card requires a legal basis or the holder's consent, and that genuine alternatives to copying can include physical inspection, electronic reading of the card or remote electronic identification. This supports the broader data-minimisation principle of verifying identity from an authoritative source where possible instead of routinely circulating and retaining full document copies.
Portugal recognises biometric remote identity verification in specific public and regulated contexts, but it does not provide a general exemption for Face Match. The controller must still establish the applicable Article 6 basis, an Article 9(2) exception where biometric processing is used, and assess necessity, proportionality, transparency and retention.
Denmark: national eID combines chip-based document verification with facial holder verification
MitID provides a concrete public-sector example of remote identity proofing using an identity document, its chip and a live face scan.
MitID: document chip and live face comparison
The Danish Agency for Digital Government explains that MitID can be obtained in the app with a passport or supported foreign identity card. The document chip is read and the user scans their face; the face scan is then compared with the portrait from the identity document to confirm identity.
This is a useful European example of the distinction between checking an authentic identity document and checking that the person presenting it is its holder. It does not mean that every private biometric verification is automatically lawful under the GDPR.
In a 2024 decision on facial recognition in a fitness centre, the Danish Data Protection Authority accepted that explicit consent can constitute an Article 9(2)(a) exception where the consent is properly informed and voluntary. A key factor was the availability of genuine alternatives that provided the same access without significant restrictions or extra cost. The case concerned access control, not remote identity proofing, but its reasoning is relevant when assessing whether consent to biometric processing is genuinely free.
For ID Scan, Denmark provides two separate lessons: the national eID demonstrates a real-world chip-to-face holder-verification flow, while Datatilsynet shows that an explicit-consent route must be assessed carefully and that a real alternative matters. ID Scan's manual holder-check fallback is intended to provide such a non-biometric route; the customer must still assess whether consent is valid in its specific relationship and context.
Sweden: the privacy authority explicitly distinguishes 1-to-1 verification from 1-to-many identification
IMY describes the exact verification pattern in which a template from a passport photo is compared with a template created from the person's live face.
1-to-1 verification: document portrait versus live face
The Swedish Authority for Privacy Protection (IMY) explains that facial recognition can be used either to verify a claimed identity or to identify a person. For verification, both biometric templates may be created at the same time: for example, one from a passport photo and one from the person's face in front of the camera. IMY explicitly calls this 1-to-1 verification.
IMY contrasts this with identification, where one template is compared against multiple templates in a database or in real time. That distinction closely matches ID Scan's holder-verification design: the live face is compared only with the portrait from the identity document being presented, not searched against a database of people.
IMY also stresses that facial recognition used to uniquely identify or confirm a person's identity involves biometric data and requires both an Article 6 legal basis and an applicable Article 9(2) exception. Its examples do not mean that every use of 1-to-1 verification is automatically lawful; legality must be assessed for the specific purpose and circumstances.
Sweden is particularly useful for terminology: its supervisory authority expressly describes passport-photo-to-live-face comparison as 1-to-1 verification and distinguishes it from 1-to-many identification. This supports describing ID Scan's Face Match as automated holder verification rather than database-based facial identification, while keeping the Article 9 GDPR safeguards fully applicable.
Finland: reliable identity verification and temporary biometric comparison
Finnish law provides useful examples of document-based identity verification and of biometric holder comparison where the comparison data are used only temporarily.
Strong electronic identification starts with a reliable identity document
Finland's strong electronic identification framework defines initial identification as verifying the applicant's identity when an identification means is issued. Where that initial identification is based solely on an official identity document, valid passports and identity cards from EEA states, Switzerland and San Marino are accepted. Finnish law also requires the provider to verify the validity of the document used for initial identification.
A legal example of one-time biometric holder comparison
The Finnish Identity Card Act contains a particularly relevant privacy-by-design principle. In the situations covered by that Act, a fingerprint or facial image may be captured from the cardholder and compared with the corresponding biometric data stored in the technical part of the identity card to establish the authenticity of the card and verify the holder's identity. The data captured for the comparison may be used only for the duration of the comparison and must then be destroyed immediately.
These Finnish provisions apply to specific statutory identity and electronic-identification contexts. They do not mean that every private use of automated facial verification is automatically lawful under the GDPR. They are nevertheless relevant examples of two principles used by ID Scan: verifying identity against an authoritative document and limiting biometric comparison data to what is necessary for a one-time holder check.
Finland therefore adds a useful privacy-by-design example: biometric data can be compared with biometrics stored in an identity document for a holder check while the newly captured comparison data are restricted to the comparison itself and then destroyed. ID Scan applies a comparable minimisation principle to its on-device 1-to-1 Face Match, while its own GDPR legal basis must still be assessed for the customer's specific context.
Norway: remote AML onboarding explicitly recognises biometric holder control
Finanstilsynet describes digital identity solutions that verify the identity document and check that the customer is the person initiating the onboarding, including by biometric control.
Digital solutions may use biometrics from the identity document
For identity confirmation without physical attendance, Norway requires additional documentation or additional measures based on risk. Finanstilsynet states that digital solutions may automatically obtain required information from an identity document, may use biometrics from the document and should include functionality to check the document's authenticity and validity.
Fully digital onboarding must also address the holder
Where a fully digital solution is used to obtain and confirm the customer's identity, Finanstilsynet states that the technical solution must at minimum check the identity document and verify that it is the customer who initiates the onboarding, for example by biometric control or an equivalent secure solution. This is directly relevant to the distinction between verifying an authentic document and verifying that the person presenting it is its holder.
The Norwegian guidance concerns customer due diligence under anti-money-laundering rules. It does not by itself provide a GDPR Article 9 exception for every biometric Face Match. The organisation must still assess the GDPR legal basis, necessity, proportionality and applicable national rules for its own use case.
Norway is particularly relevant to ID Scan's remote AML use case: the supervisory guidance separately addresses document authenticity and validity and the need to establish that the customer is actually initiating the onboarding, expressly mentioning biometric control. The reporting entity remains responsible for its own assessment and confirmation of the customer's identity.
Estonia: identity data and holder verification are explicitly distinguished
Estonian remote-identification rules require secure and unambiguous identification, while the national Eesti app clearly separates showing identity data from verifying that those data belong to the person presenting them.
Remote identification must be reliable
Estonia's anti-money-laundering rules require remote identification procedures to ensure that collected data and documents are correct and up to date and that images, video, audio and other data are gathered with sufficient quality to make the person unambiguously identifiable. If the connection fails or another technical defect occurs, the identification must fail rather than produce an unreliable result.
The Eesti app demonstrates the holder-verification question
Estonia's national Eesti app allows a service provider to verify identity through a temporary QR code. The verified document data are displayed for 30 seconds and the service provider confirms identity by comparing the retrieved document photo and personal data with the person in front of them. RIA expressly states that merely displaying document data or a document photo is not itself identity verification.
This is a useful distinction for ID Scan. The Eesti app uses a manual holder check: verified document portrait versus the person presenting it. ID Scan can automate that final 1-to-1 comparison using the portrait from the NFC chip and a live face. When that comparison is automated using biometric characteristics, the GDPR rules for biometric data remain applicable.
The Estonian sources demonstrate reliable remote identification and the difference between presenting identity data and checking the holder. They do not by themselves create a GDPR Article 9 exception for every automated biometric comparison. The legal basis, necessity, proportionality and applicable national rules must still be assessed for the specific use case.
Estonia is particularly useful for explaining why an authentic identity document or verified identity data are not the end of the process: the verifier may still need to establish that the data belong to the person presenting them. That is the holder-verification step that ID Scan performs remotely.
Ireland: official remote identity verification combines NFC, liveness and biometric face comparison
Ireland's MyGovID app provides a concrete government example of remote holder verification: passport validation, chip reading, a live selfie and biometric comparison are combined to establish identity.
MyGovID compares the live applicant with the passport
For online SAFE registration, the Irish Department of Social Protection requires a valid Irish passport and an NFC-capable smartphone. The app reads identity data and the photograph from the passport chip, uses the applicant's selfie for a liveness check and matches it against the photographs stored on the passport. If the selfie does not match the passport photograph or the photograph on the chip, the applicant cannot complete the online route.
The Irish government expressly calls this biometric processing
The Department expressly states that online SAFE registration creates and processes biometric data in the app. Biometric data from three photographs are compared to establish that the applicant is a living person and to help prevent fraudulent identities. This is a useful official example of why a one-to-one holder comparison remains biometric processing even when its purpose is verification rather than a search through a population database.
The remote biometric route is optional
Online SAFE registration is voluntary. A person who does not wish to use the app can instead complete SAFE registration in person at a Public Services Card centre. This does not determine whether consent is a valid GDPR Article 9 exception in another context, but it illustrates the importance of providing a genuine alternative to a biometric remote route.
MyGovID operates under its own Irish statutory framework. Its use of passport-chip data, liveness and biometric comparison demonstrates that these techniques can form part of official remote identity verification, but it does not make every private Face Match lawful. Each organisation must still assess its own legal basis, Article 9 exception, necessity, proportionality and safeguards.
Ireland is particularly relevant to ID Scan because the official online SAFE process separates the same security questions: is the passport valid, what identity and portrait are stored on its chip, is a live person present, and does that person correspond with the passport holder? ID Scan follows a comparable verification logic while performing its biometric Face Match locally on the smartphone and not sending a reusable biometric face template to ID Scan or the customer.
Poland: remote verification may combine document checks, liveness and 1-to-1 biometric comparison
Polish supervisory guidance distinguishes biometric 1-to-1 verification from 1-to-many identification and recognises document-to-face comparison as a control in remote financial onboarding.
UODO distinguishes 1-to-1 verification from 1-to-many identification
Poland's data-protection authority UODO explains that biometric authentication or verification checks whether a person is who they claim to be by comparing a biometric sample with one reference sample, for example one stored on an electronic card or biometric passport. UODO calls this a 1-to-1 comparison. Identification, by contrast, compares a face with a database of templates and is a 1-to-many process.
KNF recognises face-to-document comparison in remote onboarding
Polish financial supervisor UKNF describes biometric techniques such as comparing the customer's live face with the photograph on the identity document, using an appropriately high matching threshold. Its video-verification guidance also refers to document-authenticity checks, OCR and MRZ checks, and capturing the customer's face through the banking application to help establish that the customer is genuinely present in the verification process.
If the required biometric confidence level is not reached, UKNF describes escalation to an additional check, for example review by a back-office employee, live video verification or an in-person visit. A failed or uncertain automated match therefore need not be treated as a final conclusion about a person’s identity.
These sources show that 1-to-1 biometric holder verification is a recognised technical concept and can form part of regulated remote identity verification. They do not make every private Face Match lawful. The organisation must still establish an Article 6 legal basis, an applicable Article 9 exception and assess necessity, proportionality, transparency and appropriate safeguards for its own use case.
For ID Scan, Poland is particularly relevant because the official guidance separates the same questions: is the identity document reliable, is the customer actually present, and does the live person correspond with the portrait on the document? ID Scan performs the last step as a one-time 1-to-1 holder verification rather than searching a facial database.
Czechia: holder verification is distinct from document verification
Czech AML rules and supervisory material recognise remote onboarding, while biometric guidance clearly distinguishes 1-to-1 verification from 1-to-many identification.
Identity checking includes checking the person against the document portrait
Under the Czech AML framework, identity checking is not limited to reading identity data from a document. In an in-person check, the obliged entity also verifies that the person's appearance corresponds with the portrait on the identity document. This illustrates the separate holder-verification question: an authentic document alone does not establish that the person presenting it is its rightful holder.
Remote customer onboarding is part of the Czech supervisory framework
The Czech National Bank publishes the EBA Guidelines on remote customer onboarding (EBA/GL/2022/15) as part of its AML methodological and interpretative materials. Those European guidelines recognise automated remote verification and, where biometrics are used, require reliable matching between biometric data from the identity document and the customer, with liveness controls for unattended onboarding.
1-to-1 verification is different from searching a facial database
Facial-recognition guidance published by the Czech data-protection authority describes verification or authentication as comparing a person's biometric sample with one reference sample, for example a template associated with a biometric passport. That is a 1-to-1 comparison. Identification against a reference database is a different, 1-to-many process.
These sources support the distinction between document authenticity, holder verification and database identification. They do not make every private biometric Face Match lawful. An organisation must still establish an Article 6 legal basis, an applicable Article 9 exception and assess necessity, proportionality, transparency and safeguards for its own use case.
For ID Scan, Czechia reinforces the same layered model used elsewhere in Europe: verify the identity document, establish that a real person is present, and determine whether that person corresponds with the document holder. ID Scan performs the last step as a one-time 1-to-1 holder verification and does not search a facial database.
Luxembourg: 1-to-1 authentication is distinct from identification in a database
Luxembourg's CNPD distinguishes biometric authentication of a claimed identity from identification against multiple reference records, while CSSF applies the European framework for remote customer onboarding.
CNPD distinguishes authentication from identification
The Luxembourg data-protection authority CNPD explains that biometric identification determines who a person is by comparing real-time biometric characteristics with multiple reference records. Authentication instead checks whether a person is really who they claim to be by comparing the live characteristics with pre-recorded reference data for that person, which may also be stored on an individual medium such as a smart card.
This distinction is directly relevant to holder verification. ID Scan does not search for an unknown person in a facial database. It compares the live person once with the single reference portrait obtained from the identity document.
Remote customer onboarding is recognised in Luxembourg's financial framework
The CSSF publishes the EBA Guidelines on remote customer onboarding (EBA/GL/2022/15) within its regulatory framework. Those guidelines cover remote collection and verification of customer information and recognise photographs, videos and identity documents as data that may be processed during remote onboarding. Where biometrics are used, the European guidelines require reliable matching and appropriate liveness controls for unattended processes.
The CNPD's distinction between authentication and identification and the CSSF's remote-onboarding framework show that 1-to-1 biometric verification is a recognised technical concept. They do not make every private biometric Face Match lawful. The organisation must still establish an Article 6 legal basis, an applicable Article 9 exception and assess necessity, proportionality, transparency and safeguards for its own use case.
For ID Scan, Luxembourg reinforces an important distinction: verifying a claimed holder against one trusted document portrait is fundamentally different from identifying an unknown person by searching a facial database. ID Scan performs the former as a one-time 1-to-1 comparison, locally on the smartphone, without creating a central reusable biometric face database.
Greece: remote holder verification with NFC, liveness and biometric comparison
Greek public-sector and financial-sector frameworks explicitly use remote identity verification with secure identity documents, live capture, liveness controls and biometric comparison with the document portrait.
The Greek eID process closely resembles the ID Scan verification chain
The Hellenic Public Certification Authority (APED) describes remote enrolment for the Greek electronic identity using NFC-enabled Greek identity cards, passports and residence permits. During the automated session, both sides of the document are captured, the NFC chip is accessed, personal data and the holder portrait are retrieved, and a series of selfies and a short video are recorded.
The live images are compared with the portrait retrieved from the NFC chip and liveness checks are performed. Approval requires, among other things, high confidence that the person holding the phone is a real person who corresponds with the person depicted in the NFC-chip portrait, and that the identity document is valid.
Bank of Greece expressly regulates biometric remote onboarding
The Bank of Greece provides for digital customer onboarding either by video conference with a trained employee or through an automated dynamic-selfie procedure. Its rules require live face capture from different angles, liveness techniques, capture and checking of the identity document, and biometric algorithms to compare the natural person with the photograph on the identity document.
The Greek examples show that NFC-based document verification, liveness and biometric holder comparison are established techniques for remote identity verification. They do not make every private use of Face Match lawful. A private organisation must still determine its Article 6 legal basis, an applicable Article 9 exception and the necessity, proportionality, transparency and safeguards for its own purpose.
For ID Scan, Greece provides a particularly close technical comparison: trusted identity document → NFC chip and holder portrait → live face → liveness → one-to-one biometric comparison. ID Scan performs its Face Match locally on the smartphone and does not create a central reusable biometric face database.
Netherlands: Wwft client due diligence
Organisations subject to the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft) have specific obligations to identify clients and verify their identity. Remote identity verification can be used as part of such a client due-diligence process, subject to the requirements that apply to the organisation and its risk assessment.
ID Scan can support that process by combining identity-document verification with remote holder verification. Where automated biometric Face Match is used, the GDPR rules for biometric data remain relevant in addition to the Wwft requirements.
European EBA guidance on remote onboarding
The European Banking Authority (EBA) guidelines for remote customer onboarding expressly address automated remote verification. They state that, where biometric data are used, strong and reliable algorithms should verify the match between the biometric data from the identity document and the customer. For unattended onboarding, the guidelines also require liveness detection to establish that the captured person is present at the time of verification. The guidelines are technology-neutral and also describe video-conference verification as a separate method.
This closely matches the security model used by ID Scan: the reference portrait is read from the NFC chip (DG2), the person is captured live, liveness and device-integrity checks are performed, and the result is determined through a 1-to-1 Face Match. These measures are intended to reduce impersonation and spoofing risks; they do not make any remote verification method infallible.
EBA Guidelines on remote customer onboardingRead our separate Wwft explanation
See the sources we found, how remote identification fits into client due diligence and how ID Scan can support the process.
DPIA and accountability
The AP states that organisations must perform a data protection impact assessment (DPIA) before starting facial recognition. The assessment should address risks such as errors and bias, transparency, genuine choice, security, retention, secondary use and whether a less intrusive method can achieve the purpose.
For a biometric verification solution, relevant questions include:
- Are biometric templates or facial profiles sent to a server?
- Are they stored, and if so for how long and who can access them?
- Can a template later be reused for another comparison or another purpose?
- Is the comparison strictly 1-to-1, or can faces be searched against a database?
- What biometric information is made available to the organisation requesting the verification?
ID Scan can provide technical information about the verification flow, on-device processing, data flows, configurable retention and security measures to support a customer's assessment. The customer determines the purpose for which ID Scan is used and remains responsible for its own legal assessment and obligations.
This does not remove the need to assess the processing itself, but it materially changes the risk profile compared with a service that centrally stores reusable biometric templates. The customer remains responsible for assessing its own purpose, legal basis and applicable DPIA obligations.
Country-specific rules within Europe
The GDPR provides the common European framework, but national rules and supervisory-authority guidance can differ, especially for employment. We therefore do not treat the Dutch analysis as an automatic conclusion for every EU/EEA country.
Primary sources and further reading
This page explains the public sources we have found and how ID Scan is designed around them. It is informational and does not constitute legal advice. The organisation using ID Scan remains responsible for determining the applicable legal basis, national rules and appropriate verification procedure for its own use case.
Read how the technical Face Match works
See how ID Scan combines NFC document verification, live face checks, device integrity and on-device 1-to-1 holder verification.