Smile, You’re on a Facial Recognition Camera

The recent announcement that live facial recognition software was used at King Cross Station in London has sparked concern by both travellers and the UK’s data protection watchdog.  The Information Commissioner’s Office (ICO) is looking into how it was used and said it was ‘deeply concerned’ about the growing use of facial recognition technology.

In a statement the ICO said: “Scanning people’s faces as they lawfully go about their daily lives, in order to identify them, is a potential threat to privacy that should concern us all.”

But where does the law stand on the use of facial recognition software? Hannah Parsons, Principal Associate Solicitor, DAS Law, tells you what you need to know…

Is facial recognition technology legal in the UK?

Facial recognition techniques have been used on a trial basis since 2016 at events such as the Notting Hill Carnival (2016 and 2017) and Remembrance Day 2017. The Metropolitan Police have self-imposed conditions on its use to ensure compliance with the Human Rights Act 1998, in particular the right to respect for private and family life (Article 8). Facial recognition will only be used if the following conditions are met:

• The overall benefits to public safety must be great enough to outweigh any potential public distrust in the technology;
• It can be evidenced that using the technology will not generate gender or racial bias in policing operations;
• Each deployment must be assessed and authorised to ensure that it is both necessary and proportionate for a specific policing purpose;
• Operators are trained to understand the risks associated with use of the software and understand they are accountable;
• Both the MPS and the Mayor’s Office for Policing and Crime develop strict guidelines to ensure that deployments balance the benefits of this technology with the potential intrusion on the public.

The use of this new technology is also indirectly regulated by the Data Protection Act 2018 in relation to the images that are gathered and how they are handled, and the Protection of Freedoms Act 2012 which has sections relating a code of conduct regarding security surveillance devices. The pace of technological change is perhaps faster than the pace of legal change in this area.

Can the public appeal a decision to install or use facial recognition cameras?

There is no legal basis on which the public can appeal against the installation of a camera, however the Biometrics Commission which was created by the Protection of Freedoms Act 2012 has set out some general ethical principles that should be applied to any trial of live facial recognition technology. These include:

1) The public should be informed and consulted when a trial, or series of trials, is to be conducted and the purpose and general approach to evaluation explained.

2) The public should be informed at a trial location that a trial is in progress and given a contact where further information can be found/requested.

If a member of the public felt that the technologies were to be used for any unlawful recording they could look to challenge the police if they were to feel that their privacy was being invaded.  However, if the police can show that they have legitimate aim and meet the oversight and regulation framework outlined by the Security Camera Commission, Biometrics Commission and Information Commissioners Office, their use of the technology is likely to be justified.

Can I sue the police if I’m incorrectly identified as a suspect?

There are calls for parliamentary debate on this issue as there are growing concerns over how permission or an agreement is not required for one to be subject to the technology.  It is likely that a code of practice is needed to set out the parameters of when this tool can be used and exactly how this information is kept, even more that the powers attached to this does not go beyond what is necessary to identify wanted criminals.  A freedom of information request that was made to South Wales Police has revealed how innocent people have been incorrectly matched to the criminals contained in the ‘Watch List’ nine times out of ten.

The police have relied upon adhering to the data protection rules and will only keep images that can be confirmed as a match to a watch list of police suspects, missing people, and persons of interest to the police.  If an image is not matched with this list it will only be kept on record for 31 days.

The Information Commissioner’s Office has confirmed that they are going to prioritise regulations for the use of surveillance and facial recognition technology in the forthcoming year. Anyone who feels they have been misidentified by the facial recognition technology or feels their image has been taken have been taken unlawfully should contact the Information Commissioners Office in the first instance, but is also advised to take legal advice about the matter.

Am I allowed to cover my face when approaching a face recognition camera located in a public space?

Section 94(227) of the Criminal Justice and Public Order Act 1994 give the police the power to require removal of facial coverings in England and Wales if they feel they are being worn for the purpose of concealing identity and if they believe incidents involving violence may take place in any locality.

Under the Act the police have the power to ask individuals who wear religious face veils to remove them if they believe the garments are being used as a disguise. In practice it may be that the removal of the facial veil will be conducted in a private room and by an officer of the same sex as the individual.

Can I install face recognition cameras on my property?

It is highly unlikely that a member of the public would be able to install facial recognition technology at their property unless they had a specified purpose which is in pursuit of a legitimate aim and necessary to meet an identified pressing need.

If a member of the public found that someone was invading their right to privacy with the use of facial recognition technology they should report that potential breach of data to the Information Commissioner’s Office and potentially to the police to consider whether any criminal act had been committed.