Beltug position calls for legal certainty on biometric authentication

The lack of a clear legal basis for using biometric data to authenticate people creates uncertainty for organisations, even where biometric authentication is proportionate, well-secured and the only realistic way to guarantee identity. When the DPA published Recommendation 01/2021 (NL/FR) in December 2021, it offered organisations valuable guidance while inviting the legislator to establish the needed legal basis in Belgian law. Five years later, that legal framework is still missing. Beltug therefore believes it is time to revisit the DPA’s Recommendation, to give business users more practical guidance while the legislative process continues.

Use cases from the Beltug community

Biometrics isn’t a silver bullet: its ideal role is as a third authentication factor, complementing two strong identification factors. Our members described four settings where it is a genuine necessity:

• Controlled research and laboratory environments
• Pharmaceutical research and manufacturing
• Secure distribution of hazardous pharmaceutical products
• Critical infrastructure in financial services (NIS2/DORA)

Beltug’s recommendations

In the position paper, Beltug calls for:

• A clear legal basis from the Belgian legislator
• An updated, sharpened Recommendation 01/2021 from the DPA
• Practical guidance for environments demanding robust, attributable access controls
• Strict safeguards: critical zones only, break-the-glass procedures, EU sovereignty and a mandatory DPIA

Beltug will continue to engage with policy makers and the DPA so that organisations in regulated environments can benefit from greater legal certainty