A method comprising: receiving (S216), by a public device that is available for use by multiple users, and from a communication device that is designated for use by a single user , a delegation request message indicating that the single user wishes to delegate biometric authentication to the public device; transmitting (S218), by the public device and to an authentication server computer with which the single user has enrolled the communication device using a communication device identifier, a validation request message indicating that the communication device is attempting to delegate biometric authentication to the public device; after enrollment of the communication device by the single user has been verified by the authentication server, receiving (S232), by the public device and from the communication device, a data vault comprising access data associated with the single user, the data vault having been locked by the communication device using an enrollment biometric template corresponding to the single user; receiving (S234), by the public device and from the single user, a request to perform an interaction with a resource provider ; collecting (S236), by the public device and from the single user, an authentication biometric template corresponding to the single user; unlocking (S238), by the public device, the data vault using the authentication biometric template; transmitting (S240), by the public device, the access data to the resource provider in order to authorize the interaction between the single user and the resource provider; and performing (S242), by the public device, the interaction with the resource provider. receiving (S216), by a public device that is available for use by multiple users, and from a communication device that is designated for use by a single user , a delegation request message indicating that the single user wishes to delegate biometric authentication to the public device; transmitting (S218), by the public device and to an authentication server computer with which the single user has enrolled the communication device using a communication device identifier, a validation request message indicating that the communication device is attempting to delegate biometric authentication to the public device; after enrollment of the communication device by the single user has been verified by the authentication server, receiving (S232), by the public device and from the communication device, a data vault comprising access data associated with the single user, the data vault having been locked by the communication device using an enrollment biometric template corresponding to the single user; receiving (S234), by the public device and from the single user, a request to perform an interaction with a resource provider ; collecting (S236), by the public device and from the single user, an authentication biometric template corresponding to the single user; unlocking (S238), by the public device, the data vault using the authentication biometric template; transmitting (S240), by the public device, the access data to the resource provider in order to authorize the interaction between the single user and the resource provider; and performing (S242), by the public device, the interaction with the resource provider. <EOS>