This is the full text published in the Phase 7 package. Effective dates, responsible contacts and contract-specific parameters are maintained in the corresponding release and deployment records.
Intake channels
The relying organization publishes a request channel at enrollment and in its notice. When Mobile-ID receives a request through info@mobile-id.vn, intake staff identify the relevant organization and route it to the authorized entity. Do not ask users to place palm images, templates, ID copies or medical records in general email.
Register the request
Intake creates a case reference and records date, channel, request category, organization scope, response method and status. Provide an acknowledgment route. Registering a request does not itself verify identity or authorize disclosure.
Verify the requester
Verification must be proportionate to the risk and intended disclosure. Prefer an established authenticated route or approved assisted process. Do not require new palm enrollment merely to stop palm use. Suspected impersonation is escalated without revealing whether a person exists in a gallery.
Representation and assistance
Representative records identify authority, scope, expiry and verification outcome. Staff distinguish the representative from the data subject. Children, people requiring assistance and disputed authority follow a dedicated process rather than automatic denial.
Assess scope and obligations
The authorized entity assesses the request against the processing basis, actual data, preservation obligations and other people's rights. Access, correction, restriction, withdrawal or deletion requests are assessed within applicable scope. Do not promise a portability right or specific outcome before applicability is established.
Execute and respond
The case owner assigns actions to affected systems, verifies completion and responds through the verified channel. Exports exclude other people's data, secrets, infrastructure details and unnecessary raw biometrics. A refusal or partial response explains the reason and review route.
Track deadlines and escalation
Legal review establishes applicable deadlines per request and records them in the case. Track missing information, overdue actions and external dependencies. This draft does not invent a day count. Keep the requester informed under the approved process.
Closure and evidence
Closure records verification, decision, actions, system confirmations and response. Access is restricted to case handlers. Rights-handling evidence is separated from the biometric vault and follows the approved schedule. Disputes are escalated rather than automatically destroying relevant records.
Responsibility & deployment annex
Detailed responsibilities are determined by activity and deployment records; this public document does not replace customer-specific contractual annexes.
- The relying organization defines business purposes, populations and operational authority within the deployment.
- Mobile-ID supplies and operates components within the agreed scope, including integration, control configuration and related evidence.
- Device suppliers support models, firmware, SDKs and maintenance within authorization; data access is never implicit.
- Legal, security and service ownership assignments are maintained in each organization’s operating records.
Execution and evidence cycle
- Record purpose, organization, data/device scope and the business reference.
- Verify authority, applicable conditions, configuration and relevant obligations.
- Execute with data minimization, authorization and necessary evidence.
- Close with confirmations from relevant systems, response handling and remaining exceptions.
Legal and reference sources
Detailed obligations, periods and exceptions apply according to law, contract and the actual service configuration.