📋 Tender Overview
Banco de Credito del Peru was fined almost S/ 300,000. In addition, it was ordered to stop processing the data for identity validation purposes in the use of the Virtual Complaints Book. The Ministry of Justice and Human Rights (MINJUSDH), through the National Authority for Personal Data Protection (ANPD), sanctioned Banco de Credito del Peru (BCP) with a fine of S/ 124,200 (27 UIT) for the excessive and disproportionate collection of facial biometric data from its users. These personal data were obtained when users, whether or not they were clients of the financial institution, used the Virtual Complaints Book, in order to present their complaints or claims.
In addition, it imposed another fine of S/ 165,600 (36 UIT) for storing facial biometric data in its own database without obtaining the valid consent of the users. Both sanctions were confirmed in the second instance. The fine was calculated based on the year in which the infringement was committed or was detected by the ANPD (S/ 4,600 in 2022).
Citizens should be reminded that biometric data is a special category of sensitive data, since it is unique and unalterable, obtained from a specific technical treatment, related to the physical, physiological or behavioral characteristics of a natural person, which allow them to be identified or their identity to be authenticated. Due to the high risks that their treatment implies for the rights of individuals (such as restricted access to services, affecting privacy or the legitimate use of the same), they receive special protection under the Law and the Personal Data Protection Regulation.
Likewise, the ANPD ordered the BCP to implement corrective measures that include the elimination of facial biometric patterns obtained through the use of the Virtual Complaints Book; likewise, the immediate cessation of the storage and use of said facial biometric patterns for future validations of the identity of users was ordered. The ANPD recognises the importance of implementing security mechanisms to validate or authenticate the identity of users in financial transactions; however, this obligation does not exempt financial entities from evaluating alternative, less intrusive and equally effective mechanisms to verify the identity of users, limiting the processing of biometric personal data to situations in which it is strictly necessary, relevant and appropriate for the purpose of the processing.
Despite the obligation to minimise the processing of personal data, the ANPD, in the various audit actions, has been able to verify that various entities require personal data, including sensitive data, without there being a real and justified need for its processing. The ANPD reminds that the processing of personal data carried out by entities must be strictly limited to the performance of their operations, and must be linked to a specific, explicit and lawful purpose. This implies that only the personal data that is necessary, appropriate and relevant in relation to the purposes for which it was obtained must be processed. The Ministry of Justice and Human Rights (MINJUSDH), through the ANPD, remains committed to its role as an institution that guarantees the protection of personal data in Peru. Citizens who consider that their personal data has been violated can file a complaint through the in-person or virtual Reception Desk (https://sgd.minjus.gob.pe/sgd-virtual/public/ciudadano/ciudadanoMain.xhtml) or contact us by phone at 204-8020 extension 2410.
