The Irish privacy watchdog DPC has launched an investigation into Ryanair’s facial recognition technology at the request of the EU. The company says it uses that technology to “protect customers against fraud”, but according to the EU there may be a breach of privacy rules.
Passengers who book a Ryanair flight through third-party websites or through online travel agencies with which the Irish low-cost carrier does not have a partnership agreement must submit to additional verification via facial recognition. The European privacy rules (GDPR) explicitly state that this is only allowed with the consent of the consumer. The Irish privacy watchdog has received a series of complaints and will now investigate whether Ryanair is violating the GDPR rules.
The European Data Protection Council reiterated in a recent opinion that the use of biometric data, and in particular facial recognition, poses increased risks to the fundamental rights and freedoms of data subjects and that their use should be carefully considered.
Ryanair says it complies with European rules. The company insists that verification “protects customers from potential fraud” and that to meet security requirements it must “be able to verify the identity of passengers booking elsewhere.”