Facial recognition has recently become something mundane: for example, every day we can see smartphones that offer the option to unlock the phone using the owner's face.
Although this advanced functionality can be justified (and sometimes very useful) for such private needs, its use in public spaces is controversial. In these situations, it can lead to a deep intrusion into the privacy of a large number of individuals who not only did not have the possibility to express whether they want to be recorded, but often do not even know they are being recorded.
In this regard, recording large public areas by relevant authorities and recording smaller public spaces by private entities for the protection of their business are equally controversial. However, in this case, we will focus on the latter example.
What is the benefit of facial recognition in public spaces?
The benefits of facial recognition in public spaces and areas are most often mentioned in the context of crime prevention and prosecution. One of the more popular examples is video surveillance in supermarkets, where thefts are frequent, which requires establishing of reaction mechanism that will primarily discourage potential thieves from attempting theft, but also make it more efficient to locate them if a crime does occur.
When it comes to this topic, where do European countries stand?
One of the most famous examples of the "private" introduction of this type of technology is the case of a supermarket owner in the Netherlands, who attempted in 2020 to implement video surveillance with facial recognition in his store, precisely with the aim of preventing theft.
However, the Dutch Data Protection Authority prohibited such actions, leading to the adoption of a guide on the legal implications of facial recognition, which addressed numerous practical questions on this topic. In this particular case, it was stated that the supermarket owner would need to obtain consent from each individual consumer entering the store, which is practically impossible.
The main regulatory obstacle is the data protection regulations, with the GDPR at the forefront, which significantly restrict such data processing by requiring that recorded individuals consent to the recording. It is important to emphasize that implicit consent, achieved by posting a notice about recording at the store entrance and assuming that the customer agreed to be recorded by entering the store, is not sufficient.
On the other hand, the Dutch authority mentioned in the guide the previously discussed example of using facial recognition to unlock mobile phones as an exception classified under "private" needs, to which the GDPR does not apply, making the application of this functionality permissible.
Which are the main legal implications of video surveillance with face recognition?
The main question that arises is whether there is an adequate legal basis and justified purpose for processing personal data - specifically, individuals' faces, in public areas. Among the six grounds provided by the GDPR, none seem appropriate, leading to the inevitable question of the lawfulness of such data processing.
An additional problem is the difficulty in limiting the scope of data collected by recording public areas, which can easily lead to excessive data processing and violation of the data minimization principle. In other words, it is evident that recording an area with a large number of people cannot be considered proportionate when the aim is to detect only one or a few individuals. Furthermore, it raises the question of whether such processing is truly necessary and whether the purpose justifies such invasive measures.
Finally, when recording public areas, questions also arise about where and for how long the collected data is stored. Collecting a large amount of personal data about citizens leads to the necessity to ensure adequate storage and security of such data, as well as determining time limits for their retention. When it comes to recording public areas by private entities, the fact is that data controllers might be subject that lack sufficient resources, experience, and knowledge to take appropriate protective measures regarding the collected data.
Domestic regulation in terms of facial recognition
In Serbia, there are still no regulations on this specific topic.
When it comes to recognition technologies, the discussion in our country is more focused on the use of such functionalities by public entities - competent authorities, in particular. This topic initially came to the forefront when in 2019 the Ministry of Internal Affairs (“MIA”) proposed the introduction of biometric surveillance on the streets for the purpose of recognizing license plates, which resulted in the introduction of the "Oko sokolovo" system. This system does not identify the driver and is thus less invasive to individual privacy.
However, there are also discussions on introducing facial recognition functionality, regarding which the Commissioner for Information of Public Importance and Personal Data Protection (the “Commissioner”) warned that care must be taken to ensure that the faces of other individuals visible in the footage are made unrecognizable after identifying the individual whose recognition is necessary. According to the Commissioner, this would achieve a balance between privacy on the one hand and citizen safety on the other.
The issue of facial recognition video surveillance in public areas clearly brings modern technologies into direct conflict with privacy protection. Given the numerous legal implications that have yet to be resolved, it will be interesting to follow further discussions and considerations as an appropriate legal framework is defined at the international level.