The rise of facial recognition is neither a matter of if nor when anymore. No country is immune to the deployment of technology that collects biometric information. What remains in question is the best way to address the use of such tech from a privacy and data protection standpoint.
Whether it is fines, notices, warnings or guidance, data protection authorities in different parts of the world have approached dealing with facial recognition in different ways. During an IAPP Global Privacy Summit Online panel, enforcement officials admitted public use of facial recognition is most concerning to them, and enforcement actions to this point show as much.
Concerns regarding public deployments in the European Union are so high that European Data Protection Supervisor Wojciech Wiewiórowski sees a need for an outright ban of public use to properly preserve individuals' privacy rights.
"Except the numerous clauses within exceptions, we are calling for the general ban of the use of facial recognition systems for identification," Wiewiórowski said. "We understand the legal bases in national and European laws for the use of the technology in things like one-to-one verification. … But we don't want to reach the situation in which appearing in a public area means you are surrendering your privacy."
Without a ban, Wiewiórowski explained DPAs act under their own discretion when addressing facial recognition. He has seen the full spectrum of enforcement tools applied to unlawful use by law enforcement, schools and other public deployments. The majority of enforcement comes on grounds established by provisions for special categories of "sensitive data" found in Article 9 of the EU General Data Protection Regulation.
"Under this idea, the use or processing of (biometric data) should be forbidden unless there is a specific necessity or proportionality that allows for it in one of the exceptions for sensitive data," Wiewiórowski said.
Additionally, some member states have laws concerning closed-circuit TV and other video monitoring deployments, but now the EU is adding another regulatory option with its proposed artificial intelligence rules. Wiewiórowski acknowledged the direct connection between facial recognition and AI is limited, but a nuanced convergence is worth understanding, specifically with regard to biometrics used for identification.
U.K. Information Commissioner's Office Deputy Commissioner of Operations James Dipple-Johnstone believes the U.K. Data Protection Act provides a good outline for the regulation of facial recognition if the U.K. Parliament were to consider a more focused regulatory model. For now, U.K. investigations, which have mostly concerned use by law enforcement, into the use of facial recognition mostly yield guidance given the unknowns about proper versus improper uses.
"Part of what's characterized many of the cases we've looked at is very often these are organizations trialing the use of the technology itself," said Dipple-Johnstone, who indicated the ICO strives for coordinated action and effective data sharing with all relevant stakeholders to ensure proper oversight. "They have a technology that is being promoted as something that can help and assist them. … We are very much approaching it from the perspective of understanding what the new are and where good practice and guidance lies so we can build on that."
Issuing guidance is one thing, but ensuring it effectively reaches and resonates with intended parties is another. Dipple-Johnstone reeled off aspects of strong facial recognition guidance from the ICO and fellow DPAs, including their emphasis on initial assessments, general transparency regarding the construct and use of the technology, and public awareness to data subject rights.
Privacy Commissioner of Canada Daniel Therrien went further on important consistencies in DPA guidance, honing in on the context and proportionality.
"I think it's important in deciding whether or not to put in place a biometric or facial recognition system to bear in mind the objective," Therrien said. "Biometrics should not be used only because it is useful or because the technology is there. With the risks that are entailed, people should think hard about alternatives and whether the objective is necessary to use such a powerful tool."
In discussing Canada's efforts on facial recognition, Therrien opened up about the OPC's findings and general line of thinking in investigations of unlawful facial recognition use by Clearview AI and Cadillac Fairview, along with an ongoing investigation into the Royal Canadian Mounted Police's use of Clearview's tech. A decision on RCMP's case isn't far off, according to Therrien, who revealed the OPC will issue accompanying guidance on law enforcement's use of facial recognition with that final ruling.
Guidance is the optimal regulatory tool for the OPC as Canadian privacy law does not allow the regulator to levy penalties. The lack of enforcement powers leaves Therrien few options, something he hopes to address in upcoming legislative reform. Privacy law updates are one potential avenue for change, but Therrien admitted Canada might be looking at something more specific for facial recognition.
"We have tech-neutral laws that have many advantages, but currently our parliament is seized with how to regulate facial recognition," Therrien said. "It will look at whether it would be necessary to have a law specific to this particular technology. I'm not generally in favor of such specific laws, but given the risks this technology raises, I think it's an issue we need to consider."
Photo by Blake Barlow on Unsplash
