1.
Using facial recognition for
digital identification in
public services
London, 11th March 2020
Miquel Estapé

2.
Catalonia
• Region of Spain
• 7.5 M inhabitants
• 1,000 local councils
90% < 20K inhab.
Miquel Estapé
+
• +20 years in Government
• Mayor of la Roca del Valles
• VP Catalan Public Mgmt Association
• Strategy & Innovation. Open
Government of Catalonia Consortium

3.
Agenda
1. Let’s clarify facial recognition
2. Is it accurate?
3. Why?
4. Checklist & good practices
5. Examples in Government
6. Conclusions

4.
Let’s clarify
facial recognition

5.
Too much confusion

6.
Europe is not China, nor USA
GDPR

7.
Public Security vs General Public Services
Airports
Going though customs (not GDPR)
State Gov website
Provide a Mobile eID means

8.
Is facial recognition accurate?

9.
False Match = 1/1000
(identity fraud)
Accuracy = +99%

10.
Why
facial recognition
for digital identification
in public services?

11.
40 %
Online Transactions
80 %
Internet Users
Lack of a global eID is a big barrier

12.
2FA Mobile ID
On-line enrolment:
ID verification based on
info known only by the
individual & Gov
Low level of assurance
eIDAS European Regulation

13.
98%
2%
Online In-person
350 offices
80%
19
%
1%
Low Medium High
% On-line Services
per Level of Assurance
Citizens
Enrolment
Government
Offices
Citizens hate wasting their time

14.
Good practices
of using facial recognition
in public services?

15.
Regulations about online enrolment
• EU eIDAS Regulation
Assurance levels for
electronic
identification means
2015/1502
• ETSI EN 319 411-1.
Trust Service
Providers issuing
qualified digital
certificates
• NIST – Digital
Identity
Guidelines.
SP 800-63A -
Enrolment and
Identity Proofing
• EU Anti-Money
Laundering
Directive
2015/84

16.
Checklist & Good Practices
• No alternative for online
enrolment - medium LoA
• Legitimate interests: balance
goal vs rights & freedoms
• Specific & freely given consent:
alternatives for citizens who do
not want to share their bio data
• Facial recognition algorithms
evaluated by NIST
• Perform bias tests
• No central database with
biometrics data (“hashes”)
• High level security measures
• Not an automated process
human intervention
• Best practices “know-you-
customer” (AML directive)
• Be Transparent about the process
• Conduct a Privacy impact
Assessment

17.
270 Gov
offices
On-line: Medium level of assurance
ID verification based on facial recognition
• Scan ID & Verification
• Selfie
• Liveness detection
• Video recording
• Facial recognition: selfie vs photo ID
• Checking ID exists in a official Gov database
• Verification of mobile phone: 1 OTP SMS
• Final validation by a human
2FA Mobile ID

18.
Examples
in Government

19.
Conclusions

20.
Conclusions
Respects GDPR
Convenient
Safe & secure
Giving you choice
Trustworthy (?)
Cheaper

21.
Disclaimer: The views, thoughts, and opinions expressed in this presentation belong solely to the author,
and not necessarily to the author’s employer, organization, committee or other group or individual.
Thanks for your attention !
Miquel Estapé