Avoiding Unauthorized Display Of Sensitive Personal Data (Such As A User's Facial Image) During A Payment Authentication Process: Non-technical

The application underlying the discussed decision concerns a method and system for managing secure electronic payments using biometric authentication (fingerprints), a PIN code, and a stored facial image of the user, allowing transactions without physical money, cards, or mobile devices. The critical feature at issue was the display of a stored facial image of the user to the seller for identity verification, including the sequencing of this display only after biometric authentication and, for transactions exceeding 30 euros, also after PIN verification, which the appellant argued was a safety measure preventing unauthorized third parties from viewing sensitive personal data. The Board of Appeal considered this data protection requirement to be non-technical under the established Comvik approach and found all requests to lack inventive step over a combination of prior art documents D1 and D3.