The FDPIC ends its investigation into PostFinance: greater safeguards are needed in voice recognition, violation of the principle of proportionality.
On 16 May 2025, the Swiss Federal Data Protection and Information Commissioner (FDPIC) concluded an important investigation into PostFinance Ltd, concerning the use of voice recognition as an authentication method for its customers.
Biometric Data Under Scrutiny
At the heart of the investigation are voiceprints, classified as sensitive personal data under the Swiss Federal Data Protection Act (FADP). The FDPIC found that PostFinance’s processing of such data violated the principle of proportionality and failed to obtain explicit consent from users at the time of creating the voiceprint.
In fact, PostFinance merely relied on an opt-out system, whereby users had to express their wish not to participate. According to the FDPIC, this approach is inadequate for such highly sensitive biometric data.
The FDPIC’s decirions
At the conclusion of the investigation, the authority ordered PostFinance to:
- Collect the explicit consent of data subjects before creating voiceprints;
- Delete all voiceprints collected without such consent.
The voice, as other biometric data, is a permanent characteristic of the individual and, once compromised, cannot be changed like a password. This implies the use of voice recognition technologies particularly critical.
A non-final decision
PostFinance has appealed to the Federal Administrative Court, which means the FDPIC’s decision is not yet legally binding.
The investigation raises fundamental questions about the balance between technological innovation and the protection of fundamental rights, in a context where biometric systems are becoming increasingly widespread in the banking sector and beyond.
