Facts
The complainant, both a retail and a corporate customer of a bank, tried on 19 November 2022 to reset the forgotten password for a corporate account in the bank's mobile app. Corporate customers could create a digital password only through the national ID card option, which displayed a consent screen for processing facial data; declining sent the user back to the start. The complainant told the Board that the data was being processed under compulsion. The bank replied that non-consenting customers could complete the step at a branch or by telephone banking, that since 2 December 2022 corporate customers could also use a credit or debit card without any facial data, and that banking rules require two-factor authentication.
Question
Face templates are biometric data under Article 6 of Law No. 6698; under the wording then in force, such data could not be processed without the data subject's explicit consent unless a law so provided. The Board had to decide whether the fact that a non-consenting customer could not finish the process in the mobile channel meant that the service had been made conditional on consent. It also had to consider whether mentioning the alternative channels elsewhere on the website was enough when a user who declined was sent back to the start screen without explanation. The Board took into account Article 34 of the banking regulation on information systems and electronic banking, which requires two-factor authentication.
Decision
In Decision No. 2023/1310 of 3 August 2023 the Board held that the facial data processed to issue a digital password was biometric and therefore special-category personal data, so the bank had to obtain explicit consent. As customers could also use a branch or telephone banking at the time, as the website stated, the Board rejected the claim that the service had been made conditional on consent and decided that no action would be taken against the bank. It found, however, that the bank had ended the process without any explanation for customers who declined. The bank was warned to review its processes and to inform customers in an easily understood and accessible way.
Why it matters
Because a customer who refused could complete the step through another channel, the Board did not treat consent-based facial authentication as making the service conditional on consent. It found the existence of that channel sufficient, but faulted the bank for sending customers who declined back to the start without explanation and for mentioning the alternative only elsewhere on its website. The bank was told to inform customers clearly and accessibly about processes that could be misunderstood. No administrative fine was imposed. The decision summary was published on the Authority's website on 27 December 2023.
Related stages
The Board dealt separately with facial recognition for workplace entry and exit (Decision 2022/797) and with biometric time-tracking in Principle Decision 2026/921. The published summary does not name the bank. After this decision, Article 6 was amended by Law No. 7499, published in the Official Gazette on 12 March 2024; special-category data may now also be processed without explicit consent in certain listed cases.