Facial Recognition Technology In Quasi-Public Spaces – Julian Hayes Speaks To LexisNexis

BCL partner, Julian Hayes discusses UK and EU law relevant to facial recognition technology (FRT) and how such law would apply if FRT were to be used within quasi- public spaces.

What is FRT and which laws presently govern it in the UK? Are there any plans for regulation?

FRT is a form of biometric recognition technology which uses facial features, usually comparing them to images held in a database, to verify that someone is who they claim to be (eg ePassport gates at airports or identifying 'persons of interest' in a busy street or recipients of football banning orders at a football match).

There are many variations in the way in which FRT works, but in general terms, FRT works by detecting and capturing a facial image, often via CCTV footage. Using a recognition algorithm, it then standardises the captured facial image (eg by size, rotation, etc) so that it is in the same format as images held on a database ('watchlist') of known individuals. The standardised captured image is then statistically compared to images on the watchlist. If a similarity threshold, set by the FRT operator, is reached, a 'match' takes place between the captured image and an image on the watchlist, and the person is identified. The match is usually verified by a human agent before any action is taken.

At present, there is no dedicated FRT legislation or Code of Practice in the UK. Instead, depending on who is using it and why, its use is affected by the Human Rights Act 1998, as well as bringing into play considerations under:

the European Convention on Human Rights (ECHR) the General Data Protection Regulation (EU) 2016/679 (GDPR) the Data Protection Act 2018 (DPA 2018) guidance produced by the Surveillance Camera Commissioner (SCC), which is applicable in England & Wales including the Surveillance Camera Code of Practice (SC Code) potentially by the ordinary law of confidence potentially by the Regulation of Investigatory Powers Act 2000 (RIPA) where the surveillance is covert As a result of this non-specific miscellany of primary and subordinate legislation, the use of FRT falls within the regulatory remit of the Information Commissioner (ICO), the SCC, the Biometrics Commissioner and the Investigatory Powers Commissioner's Office (IPCO). Despite the proliferation of oversight bodies, concerns have been expressed by some about the speed at which FRT is being deployed and the risk that regulatory lacunae may lead to misuse. For example, although private operators of FRT (eg retail parks) are encouraged to adopt the guiding principles for system operators set out in the SC Code, there is no obligation on them to do so. Even where 'relevant authorities' (eg the police) are obliged to have regard to the SC Code, failure to act in accordance with it does not of itself make that person liable to criminal or civil proceedings.

As a result of these concerns, legislators, regulators and NGOs have...