FIDO - Personal Data Processing Information-FIDO

Last modified: 2019/12/27

In personal data processing of HUAWEI Fast Identity Online (FIDO), Huawei serves as the end user data processor, and the developer serves as the end user data controller. For appropriate and legal processing of personal data, the following are provided:

List of personal data processed by Huawei

Guidance for the developer to help the end user control personal data

List of Personal Data Processed by Huawei

Expand

Personal Data	Processing Purpose	Retention Period
Face	Biometric data of a user, which is used for password-free sign-in and payment. HUAWEI FIDO provides the local biometric authentication (BioAuthn) capability that calls the local authentication API of Android and EMUI. The collected fingerprint and face data is stored and compared in Trusted Execution Environment (TEE) on the device. The data is only processed in the secure environment on the device.	The face and fingerprint data will only be processed on users' devices. It will not be processed and stored on the cloud.
Fingerprint
Device certificate	The FIDO2 client and authenticator functions allow the user to use an external device or mobile phone as an authenticator, which complies with the FIDO2 specifications. The FIDO device certificate will be uploaded to the cloud for processing. It is used for signing, transfer, and signature verification of the user public key generated during registration. Huawei will not store the device certificate. User public and private keys are generated during registration. The user private key is used to sign the authentication data during authentication and stored in the TEE on the device. It cannot be directly obtained through any API and its processing is completely safe and reliable.	The device certificate is used for identity verification and is not stored by Huawei.
User private key		The user private key will only be processed on users' devices. It will not be processed and stored on the cloud.

Guidance for the Developer to Help the End User Control Personal Data

Face and fingerprint data involved in biometric authentication (BioAuthn) is only processed on the mobile phone. The user private key involved in FIDO2 authentication is only processed on the device. The device certificate is processed on the cloud for signature verification but not stored on the cloud. The data controller needs to provide related data subject rights and explanation for end users.