On 12 June, the Dutch Supreme Court handed down a ruling in a case concerning the obligation of payment service providers to (re)identify customers.

The case concerns a cardholder who refuses to cooperate with re-identification as part of customer due diligence under the Money Laundering and Terrorist Financing (Prevention) Act (Wwft), in particular due to the requirement to provide and allow the storage of a copy of her identity document, including a passport photograph

In the interim judgment of 13 March, the Supreme Court held that a passport photograph does not automatically qualify as biometric data within the meaning of Article 4(14) of the GDPR. For this to be the case, there must be specific technical processing of physical, physiological or behavioural characteristics for the purpose of uniquely identifying a natural person. In this context, an ordinary passport photograph may serve as the source for biometric processing, but is not automatically a biometric data element in itself.

In the referral judgment of 12 June, the Supreme Court has not yet definitively ruled on this matter, but has nevertheless referred questions regarding the classification and lawfulness of the processing of photographs for identification purposes. This is partly in light of the Comdribus judgment, in which the Court of Justice of the European Union (CJEU) ruled that the taking of fingerprints and photographs for identification purposes in a criminal justice context may involve the processing of special categories of personal data and is permitted only under strict conditions, including strict necessity and a sufficiently specific justification.

The Supreme Court has referred questions for a preliminary ruling concerning the classification and lawfulness of the processing of passport photographs, including the question of whether the capture and storage of a facial photograph for identification purposes may, under certain circumstances, be regarded as the processing of biometric data. In addition, the Supreme Court asks whether photographs in which a person is recognisably depicted can qualify as personal data revealing racial or ethnic origin within the meaning of Article 9 of the GDPR, and under what conditions this is the case.

The Supreme Court has also referred the key question regarding the retention obligation under the Wwft to the Court of Justice of the European Union. It asks whether the AML Directive, which forms the basis of the Wwft, obliges Member States to require financial institutions to retain a copy of proof of identity. In this context, the follow-up question is explicitly raised as to whether such a retention obligation also encompasses the retention of a full copy, including a passport photograph.

The key questions regarding the classification of passport photographs under Article 9 of the GDPR and the scope of the retention obligation under the Wwft therefore remain unresolved. The answers to the questions referred for a preliminary ruling will determine the future structure of customer identification and KYC processes.