Spid, green light from the privacy guarantor to the new launch methods

2 ‘reading

Guarantor’s green disc for the protection of personal data to the new methods of issuing digital identities through remote recognition, thanks to the changes in the methods of implementation of the Spid (Public System for the management of the digital identity of citizens and companies), proposed by ‘Agid (Agency for digital Italy).

Automatic audio and video session

The new remote recognition procedure introduced by Agid no longer requires the simultaneous presence of the operator of the operator Spid and the applicant, who however must make a transfer from their checking account. In short, in order to obtain Spid with the new method – as indicated in the Guarantor’s newsletter – the applicant, after a first registration on the manager’s website, will have to start an automatic audio and video session, during which he will show your identification document. and the tax identification card or health card.

The following steps

Furthermore, to avoid identity theft attempts, the procedure has been reinforced with specific security measures and cross-checks: during the audio-video session, in fact, the applicant will have to read a code received via SMS or via an application installed on the personal cell phone. The applicant is also expected to make a transfer from an Italian checking account in her name, indicating a specific code previously received in the description. All this information and the audio and video recording will then be verified by the back-office operator who will proceed with the release of the digital identity.

Sample controls

During the interlocutions for the issuance of the opinion, as an additional measure of guarantee and in order to evaluate the reliability of the procedure, the Privacy Guarantor requested that the digital identity administrator submit the requests to additional random controls, ensuring that the audio -video back to a second operator. At the end of a test period of six months of the new procedures, Agid must send the Guarantor a report with the results of these controls, to evaluate the effectiveness of the second level control. Next, Agid must send the Guarantor the weekly reports, prepared by those responsible for Spid, related to the rejected release requests of critical profiles related to the processing of personal data and which may be configured as fraudulent attempts. Such feedback may be useful for the Guarantor to carry out any investigation and assess the need to identify further technical and organizational measures to strengthen the remote identification process.