A method comprising: receiving, by a public device (104, 206, 604, 702, 900) that is available for use by multiple users, and from a communication device (106, 204, 800) that is designated for use by a single user (102, 202, 602, 704), a delegation request message indicating that the single user wishes to delegate biometric authentication to the public device; transmitting, by the public device and to an authentication server computer (112, 208) with which the single user has enrolled the communication device using a communication device identifier, a validation request message indicating that the communication device is attempting to delegate biometric authentication to the public device; after enrollment of the communication device by the single user has been verified by the authentication server, receiving, by the public device and from the communication device, a data vault comprising access data associated with the single user, the data vault having been locked by the communication device using an enrollment biometric template corresponding to the single user; receiving, by the public device and from the single user, a request to perform an interaction with a resource provider (108, 212, 608, 708); collecting, by the public device and from the single user, an authentication biometric template corresponding to the single user; unlocking, by the public device, the data vault using the authentication biometric template; transmitting, by the public device, the access data to the resource provider in order to authorize the interaction between the single user and the resource provider; and performing, by the public device, the interaction with the resource provider. receiving, by a public device (104, 206, 604, 702, 900) that is available for use by multiple users, and from a communication device (106, 204, 800) that is designated for use by a single user (102, 202, 602, 704), a delegation request message indicating that the single user wishes to delegate biometric authentication to the public device; transmitting, by the public device and to an authentication server computer (112, 208) with which the single user has enrolled the communication device using a communication device identifier, a validation request message indicating that the communication device is attempting to delegate biometric authentication to the public device; after enrollment of the communication device by the single user has been verified by the authentication server, receiving, by the public device and from the communication device, a data vault comprising access data associated with the single user, the data vault having been locked by the communication device using an enrollment biometric template corresponding to the single user; receiving, by the public device and from the single user, a request to perform an interaction with a resource provider (108, 212, 608, 708); collecting, by the public device and from the single user, an authentication biometric template corresponding to the single user; unlocking, by the public device, the data vault using the authentication biometric template; transmitting, by the public device, the access data to the resource provider in order to authorize the interaction between the single user and the resource provider; and performing, by the public device, the interaction with the resource provider.