By Jon Belcher, commercial lawyer with Blake Morgan
Facial recognition is rarely out of the headlines these days. In February, the Metropolitan Police began using automated facial recognition cameras in London. This follows on from trials carried out by South Wales Police, as well as deployments of the technology by private companies in public places such as shopping centres.
There have been various responses to the growing use of facial recognition technology. Some see the potential of the technology. For instance, the UK government fully supports the police in expanding its use. Others, such as the UK’s data protection regulator, the Information Commissioner’s Office, have taken a more cautious line, calling for a code of conduct to be drawn up to govern the technology. Meanwhile, the European Commission recently floated the idea of a five-year ban the use of such technology, amid concerns that the technology is inaccurate, discriminatory, and an invasion of privacy, although a ban was not included in its final Artificial Intelligence White Paper. So is this technology the future of policing or are we entering into a dystopian nightmare of mass surveillance?
Facial recognition technology is software that automatically scans images to ‘match’ or recognise individuals who are already known. Examples in everyday life include the unlocking of mobile phones (it’s already used by both iPhone and Android) and automatic ‘tagging’ of photos uploaded to social media. The term Live Facial Recognition, or LFR for short, is used where live images, such as CCTV, are analysed to identify particular individuals in real time.
The technology is becoming more accurate and more affordable, but it remains very controversial. It has been widely used but in some contexts it isn’t always clear what particular need it is being used to address. Is it any more useful for unlocking your phone, for instance, than fingerprint ID or simply using a numeric pass code? That may partly explain why the European Data Protection Supervisor, Wojciech Wiewiorowski, recently described LFR as ‘a solution in search of a problem’.
Although this is relatively new technology, that doesn’t mean it isn’t subject to regulation. Data protection law already recognises biometric data used for the purpose of uniquely identifying an individual as a special category of personal data, worthy of a higher level of protection. This means it can only be processed in certain restricted circumstances, where it is necessary and proportionate to the purpose for which it is used. We have already seen a number of cases in Europe which have explored how data protection law applies to LFR technology. A school in Sweden found itself in breach of European data protection law when it trialled the use of LFR to automatically recognise pupils each morning, rather than using the more traditional method of calling a register. Perhaps not surprisingly, the data protection authority found that this was a disproportionate and unnecessary use of biometric data, and the school was fined.
In the UK, the first judicial scrutiny of LFR technology came in the case of R (on the application of Bridges) v The Chief Constable of South Wales Police. Mr Bridges objected to his data being processed by South Wales Police at public places in Cardiff, and brought the claim against the police arguing that the use of LFR breached his human rights and data protection legislation. LFR was being used by the police to identify known individuals who were on a police ‘watchlist’. Mr Bridges was not on that watchlist and so, if his data was ever collected, it was not retained by the police.
The High Court found that LFR does engage human rights law. Mr Bridges’ right to privacy was infringed by being subject to LFR, but the court concluded that the infringement was justified because it was necessary and proportionate for a lawful policing purpose. The court also carried out a detailed analysis of data protection law and found that the police did not breach data protection legislation, because the use of LFR was strictly necessary for law enforcement purposes. So although the police won the case, the court made it clear that LFR is subject to human rights and data protection law, and can only be used in clear limited cases. This isn’t necessarily the end of the matter, as Mr Bridges has appealed and the case will now go to the Court of Appeal.
So the Metropolitan Police’s deployment of LFR technology is likely to be scrutinised very closely, to determine whether its use is necessary and proportionate, and that the police are getting the balance right between civil liberties and security.
As the technology progresses, future governments may wish to amend or bring in new legislation to enable LFR to be used more widely by the state. In the context of the political convulsions of Brexit, and the regular criticisms of the Human Rights Act in the press, it is not impossible to imagine a future government removing some of the barriers to more widespread state adoption of LFR technology. LFR is likely to remain on the frontline of the battle for privacy rights throughout 2020 and in the years to come.
About the author
Jon Belcher is a commercial lawyer with Blake Morgan, specialising in information governance, data protection compliance, information sharing and freedom of information issues. Jon has wide experience of drafting commercial agreements, with a specific focus on data sharing and processing agreements.
He has advised on the data protection implications of large commercial transactions, including major public sector procurements, complex data export arrangements and direct marketing campaigns. He also acted as lead advisor to clients in the media and utilities sectors in respect of GDPR compliance, and is regularly instructed by public sector bodies and charities in Wales and England on data protection matters.
About Blake Morgan
Blake Morgan is a UK law firm providing a breadth of legal services across the private, public and third sectors with a strong regional presence across southern England and Wales. The firm has six offices: Cardiff, London, Oxford, Portsmouth, Reading and Southampton.
With a long heritage and committed client base, the firm’s partners and teams provide a depth of expertise in their key sectors. The firm aims to deliver exemplary service to its clients and to make a difference through teamwork, integrity and innovation.