New technology puts control and consent into passenger hands for biometric and personal data. Here’s why “Bring Your Own Biometrics” can solve Europe’s air travel bottleneck, which is only going to get worse as passenger demand increases year on year.
By Trevor Butterworth, VP Digital Strategy & Governance
Somewhere tonight, a traveler booking a trip to Europe is comparing connections through Europe’s hubs. They aren’t thinking about data protection law; they’re thinking about how long it will take to deplane, how far the connecting gate is, how slow the lines will be, and whether missing their next flight will throw their business trip or vacation into chaos. If you’ve ever needed a connecting flight, the anxiety is real and delays are excruciating.
And as Pedro Alves, SITA’s senior vice president of borders, put it to PhocusWire, it’s a deciding factor in where to fly to: connecting passengers already avoid airports where they expect long waits; meanwhile, while airports outside the EU are using biometrics to speed them through.
This is the backdrop to the Responsible Biometrics Travel Industry Coalition, launched Oct. 1 by ACI EUROPE, Amadeus, IATA, IDEMIA Public Security and SITA. It wants the EU’s Digital Omnibus, a legislative package to streamline and harmonize Europe’s disparate digital rules,
to make room for voluntary biometric travel. The distinction here is important: for border control, biometric checks are required and governments keep biometric galleries of arriving passengers according to their own legal mandates.
The debate is over using biometrics for everything else: check-in, bag drop, lounges, and boarding. Each of these steps asks the same question — are you who you say you are? And that’s the reason for biometrics in travel: to verify your identity quickly, and to protect you while it’s being verified. Here, biometric authentication could simplify and speed up processes that presently require manual document checks. For airlines and airports, as much as passengers, speed is a critical issue, and not just to improve how people experience air travel today. Everyone has to contend with how air travel to Europe is increasing.
In its long-term outlook, the European Organisation for the Safety of Air Navigation — EUROCONTROL —, which runs Europe’s air traffic network, forecasts 15.4 million flights in Europe in 2050, an increase of 52% compared to 2023. For Europe’s hubs, It also expects the demand for an additional 1.1 million flights that people and airlines would want to operate but that airports can’t fit. So there are bigger issues here than traveler convenience: every minute saved can be measured in additional infrastructure that doesn’t need to be built.
This is why we believe the coalition is right to promote the benefits of voluntary passenger biometric authentication. As a technology company that has pioneered passenger biometrics in verifiable credentials — what we call “Bring Your Own Biometrics” — we believe that Europe can embrace and enjoy seamless digital travel if its rules distinguish between airports and airlines storing travelers’ biometric data and travelers carrying it on their own phones and presenting it voluntarily to those airlines and airports.
Why travelers want to use biometrics but don’t trust them
First, this is what passengers want to be able to do. In IATA’s 2025 Global Passenger Survey, cited in the coalition’s manifesto, 74% of travelers said they would rather use biometrics than passports and boarding passes, provided they were confident their data was secure. Unfortunately, Phocuswright has found that this confidence is in short supply: only 36% of U.K. travelers, 32% of Germans and 25% of the French say they mostly or completely trust biometric airport access. In other words, the problem is that many people do not trust existentially-important personal data — their faces — being stored in a central database, where it is vulnerable to hacking or misuse. GDPR — the EU’s data protection legislation was a response to these legacy cybersecurity and privacy concerns.
But the technology has dramatically changed since GDPR was written. Centralized databases existed to perform verification because, short of reading a passport chip at every step, there was no other way of proving someone’s identity digitally. Proof required calling home or cross checking. How otherwise could you verify a person biometrically if you didn’t already have their biometric for comparison?
This is no longer the case.
Bring Your Own Biometrics
Verifiable credentials enable the proof to travel with the data. With an authenticated biometric in a verifiable credential, a person carries a verified biometric of themselves in a digital wallet on their mobile device. This data is digitally signed, meaning that anyone who wants to verify it uses software to perform cryptography on the data presented. This allows the verifier to instantly prove who issued the credential and that the data hasn’t been tampered with, even offline. The credential with the biometric can’t be shared, stolen, or forged. If a person loses their phone, the credential is, effectively, lost forever and has to be reissued, much like a lost passport.
For travel, a Digital Travel Credential, built to specifications created by the International Civil Aviation Organization, carries the data from a traveler’s passport chip, including the biometric image, digitally signed by the issuing government. It stays on their phone until the traveler chooses to share it. At a checkpoint, a camera takes a live image, software confirms the credential is genuine and compares the two faces one to one, and then data can then be deleted.
A traveler-held credential removes the need for a large centralized store of biometric data, and what isn’t stored, can’t be hacked. It also gives each person tamper-evident proof of who they are, right at the moment when AI-generated documents and deepfakes make identity fraud cheaper and more difficult to spot. Finally, it fits Europe’s own bet on user-held data: every member state must offer an EU Digital Identity Wallet by year’s end.
Of course, some airport processes will require temporary storage of biometric data. As Alves acknowledged, hands-free processing still needs some short-term storage of biometric data. The answer here is to let the traveler make that trade, step by step. At bag drop, tapping a phone can prove they’re the person on the boarding pass, with no biometrics at all. At other checkpoints, they can glance at a camera for a one-to-one match that needs to store nothing. If they’d rather leave her phone in her pocket, they can opt in to a temporary gallery of faces for their flight. Anyone who opts out can take a non-biometric route, as the coalition’s manifesto insists. Consent is real when the person holds the data and can see what each choice requires.
The way to show that this works is through monitored pilots that gather evidence and then by harmonizing rules. Europe set the benchmark for privacy law. It should now make room for the technology that lets travelers keep control of their biometric data and choose to use it.
To learn more about Indicio Proven and how we implement globally-interoperable Digital Travel Credentials for airlines, airports, borders, and cruise ships contact us here.
To read our marketing brief on what digital travel will feel like, click here.
