ODDA calls on MEPs to back Amendment 1043 and close the fraud prevention gap in GDPR
ODDA calls on MEPs to back Amendment 1043 and close the fraud prevention gap in GDPR
Fighting romance fraud can feel like fighting the Hydra – remove one fake profile and another appears in its place. Platforms need to be able to stop fraudsters creating new accounts in the first place, and the law needs to let them.
This week, the ODDA wrote to Members of the European Parliament on the Committee on Industry, Research and Energy (ITRE) and the Committee on Civil Liberties, Justice and Home Affairs (LIBE), urging them to retain Amendment 1043 to the Digital Omnibus in the committees’ final report.
Tabled by co-rapporteur MEP Aura Salla and other EPP Members, AM 1043 would add a new legal basis to Article 9 of the GDPR. It would allow platforms to process sensitive data, including biometric data, where it is necessary and proportionate to prevent fraud, identity misuse, account takeover and abuse.
Why it matters
Fraudsters increasingly use convincing fake profiles, sometimes built with AI-generated photos, to win a victim’s trust before asking for money in response to an invented crisis or a fake investment. When a platform removes their account, they simply register a new one. Document checks don’t solve this because they are easy to fake with synthetic identities and don’t stop re-registration.
The technologies that do work include:
– Liveness and presentation-attack detection, confirming a real person is present rather than a photo, recording or mask
– Deepfake and injection-attack detection, spotting synthetic or manipulated images and video
– Face matching, stopping banned users from returning and linking accounts run by the same person
All three involve biometric data, which Article 9 GDPR treats as a special category. The resulting legal uncertainty makes platforms hesitant to deploy them, even when the aim is clearly to protect users.
The scale of the problem
According to the EU Agency for Fundamental Rights’ 2026 Eurobarometer survey, one in four people in the EU has fallen victim to online fraud. Impersonation scams are the second most common type, and Europol has identified romance fraud as a priority crime area.
Safeguards stay in place
AM 1043 does not weaken data protection. Necessity, proportionality, purpose limitation and data minimisation would all continue to apply.
The Commission’s original proposal only allows biometric checks where the data stays under the user’s sole control. As our briefing explains, that excludes exactly the cases the checks exist for ie a hijacked account, or a banned user returning under a new identity.
Next steps
Technical discussions, where legislators and experts scrutinise the text line by line, take place next week. We will continue to engage with MEPs and their teams ahead of them.
