Paying with your face: what changes when the key is you

It is tempting to read this as product news. It is not. A face used to recognise a specific person is not a photograph: it is biometric data for the purpose of uniquely identifying an individual, and the GDPR places it among the special categories of Article 9(1). The practical consequence is that an Article 6 basis is not enough: a condition under Article 9(2) is needed as well, and in retail the one realistically available is a single one, explicit consent under point (a).

That opens the real question, which is not about Revolut but about anyone who wants to copy the model. Consent counts if it is freely given, and freely given means that whoever says no loses nothing. As long as there is an ordinary till next to the biometric one, the condition holds. The moment the face becomes the only way to pay, or the way that skips the queue while the other does not, consent stops being a legal basis and becomes a formality collected under pressure.

• A compromised identifier cannot be changed. A card is blocked, a password is rewritten, a face is not. That is why Article 9 treats these data differently, and it is not excess caution.
• The impact assessment is not optional: large-scale processing of special categories, Article 35(3)(b).
• Withdrawing must be as easy as enrolling, and withdrawal must produce a verifiable effect, not just a tick that changes state.
• There must always be a real alternative at the same price and with the same convenience, otherwise consent is not freely given.

For the DPO of a shop offered such a system, the question to put to the supplier before any other is who decides what. If the supplier sets the purposes and the means and the shop merely hosts the terminal, the shop is not the controller of that processing; but it remains the controller of the decision to install it on its premises, and it must inform those who walk in, guarantee the alternative and know where the images end up. «We do not store the data» is an answer about where, not about who, and the two are confused constantly.

On the European side the frameworks add up, they do not replace one another. The AI Act does not prohibit one-to-one verification carried out with the person's consent — the prohibition concerns real-time remote biometric identification in publicly accessible spaces for law enforcement purposes — but it still places biometric systems among the regulated ones, with obligations of their own that add to the GDPR rather than absorbing it. Similar experiments have already taken place in the Union: Mastercard and PayEye tested biometric payment in five Empik stores in Poland in June 2024.

What to take away, concretely. If a client asks for an opinion on a till that recognises faces, four things must be written down before anything else: the Article 9(2) condition being relied on; the impact assessment, carried out before and not after installation; the separate retention periods of the biometric template and of any image kept as a fallback; and the non-biometric alternative, described so that it is visible that nobody is worse off choosing it. Without those four, the finest notice in the world describes processing that has no solid basis.