The Indian government is enabling banks to use facial recognition and iris scans to confirm the identity of individuals for transactions that surpass a specific annual limit, as a way to combat fraud and tax evasion, according to sources who spoke to Reuters.
Some large private and public banks have already started using this option, but the information about this advisory is not public and has not been reported before.
The use of facial recognition and iris scans to verify transactions is not mandatory and is only used in situations where the Permanent Account Number (PAN) card, which is used for tax purposes, is not provided to the bank.
The idea of banks utilizing facial recognition technology has raised concerns among privacy experts as India currently lacks laws specifically addressing privacy, cybersecurity, and facial recognition. Pavan Duggal, an advocate and cyber law expert, stated that this raises significant privacy concerns.
The Indian government plans to seek parliamentary approval for a new privacy law by early 2023. The new measures allow banks to use facial recognition and iris scans to confirm the identity of individuals making deposits and withdrawals that exceed 2 million rupees in a financial year, as long as they provide their Aadhaar identity card, which has a unique number linked to their fingerprints, face, and eye scan, according to two unnamed government officials.
In December, India’s finance ministry instructed banks to take action based on a letter from the Unique Identification Authority of India (UIDAI) which suggested using facial recognition and iris scanning for verification, particularly in cases where fingerprint authentication fails.
The UIDAI, which is responsible for issuing Aadhaar cards, did not mention a framework for obtaining consent or what actions banks can take if a customer refuses. A UIDAI spokesperson stated that Aadhaar verification and authentication is only done with the explicit consent of the user and that the use of Aadhaar-based biometric authentication helps prevent misuse.
The UIDAI regularly advises all entities involved in authentication and verification to use face or iris authentication for residents whose fingerprint authentication fails. He also added that authentication and verification does not involve the storage of data.
This advisory follows a government order from last year that required the use of an Aadhaar card or PAN number for deposits or withdrawals exceeding 2 million rupees in a financial year. The federal finance ministry did not respond to requests for comment.