Federal Data Protection and Information Commissioner (FDPIC) — PostFinance AG
The FDPIC found PostFinance's creation of customer voiceprints for biometric authentication violated proportionality and lacked explicit consent, and ordered it to obtain explicit consent before creating voiceprints and delete those lacking consent (under appeal).
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-06. Every holding carries a short verbatim quote from that text.
- Decided by
- Federal Data Protection and Information Commissioner (FDPIC)
- Parties
- Federal Data Protection and Information Commissioner (FDPIC) v. PostFinance AG
- Decision date
- May 16, 2025
- Remedy
- PostFinance was ordered to obtain explicit consent from data subjects when creating voiceprints for voice recognition and to delete existing voiceprints for which explicit consent was not given.
- Appeal
- Appeal pending
Key holdings
PostFinance's processing of biometric voice data for authentication violates the data protection principle of proportionality.
“PostFinance's processing of biometric data for authentication purposes violates the principle of proportionality.”
The FDPIC ordered PostFinance to obtain explicit consent before creating voiceprints for voice recognition.
“ordered PostFinance to obtain an explicitly given consent of data subjects when creating voiceprints for use in voice recognition.”
PostFinance appealed the decision to the Federal Administrative Court, suspending its full legal effect.
“PostFinance has appealed the FDPIC ruling to the Federal Administrative Court.”
In plain English
The Federal Data Protection and Information Commissioner examined whether PostFinance AG complied with data protection regulations when using voice recognition as an authentication method. Following its investigation, which concluded on 16 May 2025, the authority determined that PostFinance processed biometric data in a manner that violated data protection law and the principle of proportionality. Specifically, the company created voiceprints without obtaining explicit consent from customers, forcing individuals who did not wish to use voice recognition to actively opt out. Because voiceprints are biometric data enabling individual identification, they constitute sensitive personal data that are inextricably tied to a person's identity and cannot be recreated if misused. The regulator ordered PostFinance to obtain explicit consent from data subjects before creating voiceprints for voice recognition. Furthermore, the authority required PostFinance to delete all existing voiceprints created without explicit consent. PostFinance has appealed this ruling to the Federal Administrative Court, meaning the decision has not yet taken full legal effect.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.