Postfinance illegally collected customer data other banks also come under pressure

The Federal Administrative Court has ruled that Swiss bank Postfinance violated data protection laws by creating biometric voiceprints of customers without their explicit consent. The court determined that merely informing callers about audio recording does not constitute valid permission for such sensitive biometric processing. Consequently, the bank faces a deadline of February 15, 2027, to either obtain retroactive approval from affected clients or delete the stored voice data entirely. This landmark decision establishes that active, affirmative consent is required before companies can generate digital codes based on human voices, setting a new legal standard for privacy in customer service interactions. The practice at issue began in autumn 2018. When customers called the Postfinance hotline, they heard an automated announcement stating that the conversation would be recorded for security and identification purposes. The message instructed listeners who did not wish to participate to inform their customer advisor. However, the bank interpreted continued participation during the call as implicit agreement. Under this system, software analyzed hundreds of individual vocal characteristics, including pronunciation, speaking speed, and emphasis, to create a unique digital code known as a voiceprint. This technology allowed the bank to identify returning callers by their voice alone, even if they were hoarse or switched languages, although loud background noise could interfere with accuracy. The Federal Data Protection Commissioner challenged this approach, arguing that voiceprints are biometric identifiers similar to fingerprints or facial scans. Unlike passwords, these traits are intrinsically linked to a person and cannot be changed after a data breach. Furthermore, artificial intelligence can now mimic voices convincingly enough to potentially bypass biometric security systems. Postfinance defended its method, claiming it was secure, efficient, and popular. The bank argued that it saved approximately 720,000 Swiss francs annually compared to other identification methods. It maintained that providing notice and an option to opt out satisfied legal requirements, leading it to contest the regulator’s initial order. The Federal Administrative Court rejected the bank's defense. The judges emphasized that the human voice is a highly personal attribute that reveals information beyond just language, including emotional states, health conditions, and personality traits. Therefore, the right to personality protection carries significant weight. The court held that a passive consent model, where customers must actively object to prevent data collection, is legally insufficient. Only explicit, active consent allows a company to process such biometric data. While acknowledging the economic efficiency of voice recognition, the court prioritized fundamental privacy rights over operational convenience. Postfinance announced it will comply with the ruling by deleting all collected voiceprints by the February 2027 deadline. The bank stated it had already adjusted its procedures in February 2026. It now employs a new speech robot that asks customers for specific permission before identifying them via voice. The judgment remains subject to appeal to the Federal Supreme Court. The ruling extends implications beyond Postfinance to other financial institutions in Switzerland. The Zurich Cantonal Bank, for instance, currently uses a similar procedure. Its website describes a process where a voiceprint is created after any call lasting at least sixty seconds. Customers wishing to have this profile deleted must subsequently contact a customer advisor. Given the administrative burden and legal risks highlighted by the Postfinance case, other banks using comparable automatic voice recognition systems may face increasing pressure to modify their practices. The decision signals a stricter regulatory environment for biometric data collection in customer-facing services across the country.