This post is also available in: עברית (Hebrew)
The use of live facial recognition (LFR) both in law enforcement and for other purposes is regulated, albeit controversial. Facial recognition technology clearly involves the processing of personal and often special category data. As such, its use comes within the remit of data protection regulators.
LFR is typically deployed in a similar way to traditional CCTV. It is directed towards everyone in a particular area rather than specific individuals. It has the ability to capture the biometric data of all individuals passing within range of the camera automatically and indiscriminately. Their data is collected in real-time and potentially on a mass scale.
Real-time facial recognition systems are AI systems. The EU has recently published a draft AI (Artificial Intelligence) Regulation which categorizes the use of real-time biometric identification systems in publicly accessible spaces for law enforcement purposes as ‘unacceptable risk’ except when used for certain restricted purposes.
The UK Information Commissioner’s Office (ICO) has published an Opinion focusing on the use of live facial recognition in public places by private companies and public organizations.
The ICO investigated or assessed 14 examples of LFR deployments and proposals and conducted wider research. The Opinion focuses on the use of LFR for the purposes of identification and categorization. It does not address verification or other one-to-one uses.
Essentially, this means that there is a high bar to the lawful use of LFR in public places for automatic and indiscriminate use. Of the 14 examples of LFR deployments and proposals analyzed by the ICO, not one organization was found to be fully compliant with data protection law in their use of LFR and all either chose to stop or did not proceed with its use.
According to lexology.com, this does not mean that LFR can’t be used. It means that care needs to be taken and the guidance followed before it is deployed and while it, or the data it generates, is used.