Live Facial Recognition deployment and data protection compliance

On paper, using AI-based Live Facial Recognition (LFR) technology for security and law enforcement makes perfect sense. It improves accuracyIn data protection terms, the concept of ensuring data is not incorrect or misleading., takes the guesswork out of identifying perpetrators, helps protect businesses, and reduces crime. All in all, it offers extraordinary potential in offender identification, threat detection, and access control.  However, despite its benefits, LFR technology brings significant data protection and compliance challenges that organisations must carefully address before deployment.

In this blog, we delve into the challenges of LFR implementation and data protection compliance. Using a night-time economy scenario, we explain how businesses can navigate these challenges whilst maximising the technology’s advantages for safety and security. 

Overcoming security challenges with LFR in the night–time economy

The night-time economy has some unique challenges for security management. Clubs, bars, and other venues often struggle to identify individuals who’ve been banned or who pose security risks. Typically, it relies heavily on human memory, which is particularly error-prone in tough conditions such as low-light conditions and crowded environments. 

Enter LFR technology. By combining LFR software with Body Worn Video (BWV) cameras, security staff can identify potential threats accurately and swiftly. But this technology does raise its own unique set of privacy concerns around data protection. 

The main challenges of LFR deployment in the night-time economy 

• Sub-optimal conditions – a key challenge in deploying LFR in night-time environments is the less-than-ideal conditions. Capturing multiple faces in a low-lit, busy, dynamic environment may impact the technology’s accuracy and reliability 
• Public perception – there’s a general suspicion of facial recognition technology among the public, which can lead to resistance around its deployment and potentially hinder the effective implementation of LFR systems 
• Excessive data capture – traditional CCTV systems that utilise LFR often capture more data than necessary, raising concerns about privacy infringement, including collateral intrusion and data minimisationThe third GDPR principle, requiring organisations to only collect the personal data that is truly necessary to fulfill each purpose for data processing. principles 
• Keeping data – storing facial recognition data for extended periods can violate data protection regulations and increase the risk of data breaches and challenges to its use 

Live Facial Recognition data protection compliance: What’s the solution?

The good news is that organisations can address these challenges with a comprehensive data protection strategy. One that balances security with privacy concerns by incorporating the following key practices: 

1. Transparency and public engagement 

Be open and honest about your LFR deployment with everyone who needs to know. Issue press releases, hold public consultations, and run webinars. Provide clear information in the form of privacy notices for data subjects that include information about the technology’s use, purpose, and safeguardsWhen transferring personal data to a third country, organisations must put in place appropriate safeguards to ensure the protection of personal data. Organisations should ensure that data subjects' rights will be respected and that the data subject has access to redress if they don't, and that the GDPR principles will be adhered to whilst the personal data is in the..., and you’ll build trust and get ahead of any public concerns. 

2. Targeted data capture

Unlike traditional CCTV, BWV cameras have a much more intimate deployment profile and therefore a narrower field of vision. This reduces excessive data capture, meaning less collateral intrusion and interference with the data protection rights of individuals not on a designated ‘watchlist’. What’s more, BWV cameras can also assist organisations in adhering to the principle of data minimisation when used correctly. 

3. Efficient data processing and deletion

Processing data quickly and deleting images that are not on any identified ‘watchlist’ near instantaneously can address concerns about excessive data retentionData retention refers to the period for which records are kept and when they should be destroyed. Under the General Data Protection Regulation (GDPR), data retention is a key element of the storage limitation principle, which states that personal data must not be kept for longer than necessary for the purposes for which the personal data are processed., while ensuring only relevant data is kept thereby reducing data protection risks. 

4. Curated watchlists 

Carefully managing the reference database of images used for matching can help limit the scope of data processing, ensure limited data is processed and improve accuracy of any potential matches. 

The value of Data Protection Impact Assessments (DPIAs) 

Before deploying LFR technology, you’ll need to carry out a comprehensive and detailed Data Protection Impact AssessmentA formal documented assessment which allows decision-makers to identify, manage and mitigate any data protection risks associated with a project. (DPIA). This will help identify and mitigate risks associated with the processing of personal dataInformation which relates to an identified or identifiable natural person., including special category dataTypes of personal data listed in Article 9(1) GDPR that are considered sensitive and thus require extra protection. Article 9(1) lists data relating to: • racial or ethnic origin • political opinions • religious or philosophical beliefs • trade union membership • genetic data • biometric data • health • sex life • sexual orientation Where these types of personal... like biometrics. 

Key elements of a DPIA include: 

• Details of the nature, scope, context, and purposes of the data processing 
• An assessment of the necessityThe purpose of the personal data processing activity must not be able to be achieved by a less intrusive method. and proportionalityA balance must be struck between the means used and the intended aim to ensure that a processing activity is proportionate. of your processing 
• Identification of the risks and measures required to mitigate them 
• Consultations with relevant stakeholders including internal departments, third parties such as businesses the LFR is being deployed as well as privacy groups and data subjects themselves 

Ensuring fairness and compliance 

To make sure LFR systems are effective, fair, and maintain compliance standards, your organisation should also: 

• Test rigorously – comprehensively test your LFR systems, involving third parties to assess accuracy and possible biases 
• Communicate clearly – display visible signage, utilise unique methods such as QR codes linking to privacy statements and other types of online and offline communications to inform people why, when, how, and where you’re using LFR technology 
• Evaluate regularly – frequently assess your LFR system’s performance, accuracy, and compliance with data protection regulations including revisiting your DPIA on a regular basis
• Create accessible complaints procedures – provide clear channels for individuals to raise concerns or exercise their data protection rights 

The future of LFR and data protection

As LFR technology evolves and finds new applications, having strong data protection processes and procedures in place will become ever-more important. Organisations will need to keep up to date with new regulations, too, whether driven by EU or UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU. or CCPA in the US.  

By carefully balancing security needs with data protection rights, organisations can reap the benefits of LFR technology, all whilst keeping compliant with data protection regulations. As we move forward, the responsible deployment of such technologies – whatever the sector – will be key to building public trust and ensuring their long-term success. 

Key takeaways: Live Facial Recognition data protection compliance

1. Transparency is crucial – engage with the public and data subjects early on in the processA series of actions or steps taken in order to achieve a particular end. and provide clear information about using LFR.
2. Minimise unnecessary data capture – targeted technologies like BWV cameras assist to reduce excessive data collection.
3. Manage data efficiently – ensure you process and delete non-matching data quickly.
4. Review regularly – by completing thorough DPIAs and carrying out periodic evaluations of LFR systems. 

For a real-life example of LFR deployment, read our Reveal Media case study. 

To better understand some of the key issues surrounding live facial recognition data protection compliance and BWV cameras, read this interview with specialist DPO, Paul Collier, by the Dutch Association of Data Protection Officers (NGFG). You’ll need to translate it into English. 

Get in touch with our team if you’re interested in how we can help support your LFR deployment and support your data protection compliance. 

______________________________________________________________________________________________________________________________

In case you missed it… 

• Compliance with the AI Act Part 3: Who must comply and what are the obligations
• How to apply the GDPR to historic records
• Understanding data protection liabilities for C-suite executives and senior leaders 

______________________________________________________________________________________________________________________________

For more news and insights about data protection follow The DPO Centre on LinkedIn