WIREDGOV

Blog posted by: Elizabeth Denham, Information Commissioner, 09 July 2019 - Live facial recognition technology - data protection law applies.

Any organisation using software that can recognise a face amongst a crowd, then scan large databases of people to check for a match in a matter of seconds, is processing personal data.

For the past year, South Wales Police and the Met Police have been trialling live facial recognition (LFR) technology that uses this software, in public spaces, to identify individuals at risk or those linked to a range of criminal activity - from violent crime to less serious offences.

We understand the purpose is to catch criminals.  But these trials also represent the widespread processing of biometric data of thousands of people as they go about their daily lives.  And that is a potential threat to privacy that should concern us all.

LFR is a high priority area for the ICO.  My office has been conducting an investigation, monitoring the trials carried out by the police.  The relevant forces piloting this technology have cooperated with our investigation and the ICO has learned a lot from our deep dive in examining how it works in practice.  Legitimate aims have been identified for the use of LFR.  But there remain significant privacy and data protection issues that must be addressed, and I remain deeply concerned about the rollout of this technology, which represents a step change from the CCTV of old.

I believe that there needs to be demonstrable evidence that the technology is necessary, proportionate and effective considering the invasiveness of LFR.

Our guidance for police forces considering LFR is:

• Carry out a data protection impact assessment and update this for each deployment - because of the sensitive nature of the processing involved in LFR, the volume of people affected, and the intrusion that can arise. Law enforcement organisations are advised to submit data protection impact assessments to the ICO for consideration, with a view to early discussions about mitigating risk.
• Produce a bespoke ‘appropriate policy document’ to cover the deployments - it should set out why, where, when and how the technology is being used.
• Ensure the algorithms within the software do not treat the race or sex of individuals unfairly