GDPR Compliance

Beyond the secure handling of personal data, there are additional considerations when the outcome of that verification results in a practice that could impact an individual protected by the GDPR, such as an “automatic refusal of an online credit application or e-recruiting practices.” Fully automated verification solutions that fail to give the end user the right “to obtain human intervention on the part of the (data) controller, to express his or her point of view and to contest the decision” (Article 22(3) GDPR) are not permissible under the GDPR.

To address these privacy requirements, Jumio has robust controls in place, including those described below.

5 Critical Ingredients for GDPR Compliance & Online Identity Verification

1. Human Review
The GDPR gives data subjects (i.e., your organization’s end users) the right not to be subject to decisions solely based on automated processing that produce “legal effects” for them or otherwise “similarly significantly affects them.” As increasingly more online verifications are carried out by algorithms, concerns have been raised about the lack of transparency behind the technology, which leaves individuals with little understanding of how decisions are made about them.

Since Jumio takes a hybrid approach to online identity verification — combining machine learning, AI, computer vision and biometrics with human review — we’re able to provide much greater transparency about the rationale for acceptance or rejection for any given identity verification transaction.

2. Machine Learning
With the GDPR, vendors should deploy and train their AI models in a way that seeks to prevent bias and potential discriminatory effects on the data subjects.

Jumio’s machine learning approach builds in prevention of bias and discrimination in the decision-making process by continuously testing against those factors. Furthermore, Jumio incorporates data privacy and security at every stage of the machine learning workflow including initial data capture, ID preprocessing, data tagging, algorithm training and model deployment.

3. Data Retention
The GDPR requires that personal data should be “limited to what is necessary for the purposes for which they are processed,” and requires personal data storage being “limited to a strict minimum.”

Jumio has strict controls in place to support the GDPR’s data minimization and storage limitation requirements ensuring that personal data that is no longer needed is discarded appropriately and in a timely fashion. Our enterprise customers can customize data retention policies based on their unique business needs.

4. Breach Notification
The GDPR requires companies to ensure that they have the controls in place to achieve notification of personal data breaches to the appropriate parties “without undue delay.”

Jumio regularly tests our robust notification processes and procedures that would be used in the event of a security incident, including a personal data breach. This ability helps our business customers manage their own breach notification and mitigation processes.

5. Data Encryption
The GDPR requires “appropriate” measures to ensure security of personal data, such as encryption, ensuring confidentiality, restoring data access and regular auditing/testing.

Jumio regularly subjects our security practices to stringent regulatory security audits, vulnerability scans and penetration tests to ensure its security measures comply with industry standards, including PCI DSS and ISO 27001 certifications. All personal data, including images of government-issued IDs and biometric data, is encrypted in transit via TLS encryption using strong cipher suites and at rest with military-grade, 256-bit AES encryption.