Accelerate Your Journey to GDPR Readiness
Jumio is not only fully GDPR compliant as a data processor, with a robust and transparent program for maintaining all standards laid out in GDPR, but also our identity verification solution is a key GDPR enabler, offering customers the ability to maintain data protection and contribute to their compliance with GDPR requirements.
GDPR gives data subjects (i.e., your online customers) the right not to be subject to decisions solely based on automated processing that produce ‘legal effects’ or other significant effects. As increasingly more online verifications are carried out by algorithms, concerns have been raised about the lack of transparency behind the technology, which leaves individuals with little understanding of how decisions are made about them.
Since Jumio takes a hybrid approach to online identity verification, combining machine learning, AI, computer vision and biometrics, coupled with human review, we're able to provide much greater transparency about the rationale for acceptance or rejection for any given identity verification transaction.
Many identity verification vendors aggregate data across multiple customers to develop their machine learning algorithms. With GDPR, vendors can only develop specific AI models trained on the data of a given customer and cannot leverage data from other customers to create more comprehensive models.
Jumio’s compliant machine learning approach builds in data privacy and security at every stage of the machine learning workflow including initial data capture, ID preprocessing, data tagging, algorithm training and model deployment.
GDPR requires that personal data should be ‘limited to what is necessary for the purposes for which they are processed,’ and requires personal data storage being ‘limited to a strict minimum.’
Because Jumio is PCI-DSS compliant, we are already mandated to adhere to strict data retention procedures ensuring that personal data that is no longer needed is discarded appropriately and in a timely fashion. Our enterprise customers can customize data retention policies based on their unique business needs.
GDPR requires data processors to notify the controller ‘without undue delay’ once aware of a data breach. Most identity verification vendors don’t have established or tested processes in place for data breach notifications.
Because Jumio is already PCI-DSS compliant, we regularly test our notification processes and procedures for dealing with data breaches. This ability helps our business customers manage their own breach notification and mitigation processes.
GDPR requires data processors to have ‘appropriate’ measures to ensure security of personal data, including encryption, ensuring confidentiality, restoring data access and regular auditing/testing.
Because Jumio is PCI DSS Level 1 compliant, we regularly subject our security practices to stringent regulatory security audits, vulnerability scans and penetration tests to ensure compliance of the product. All personal data, including ID documents and selfies is encrypted twice: all data is encrypted in transit via TLS encryption using strong cipher suites and at rest with military-grade 256 bit AES encryption.
International Director at the Payment Card Industry Security Standards Council (PCI SSC)
Enable GDPR compliance into your identity verification process quickly and easily with Jumio's Netverify® Trusted Identity as a Service solutions. Start by requesting more information and we’ll be in touch shortly.