Information Commissioner’s Opinion on the use of live facial recognition in public places

I am writing to let you know that the Information Commissioner has today published her Opinion on the use of live facial recognition (LFR) technology in public places. This document sets out the Commissioner’s view on how UK data protection law applies to the use of this particular type of facial recognition technology in a public setting.

The Commissioner previously published an Opinion on the use of LFR in law enforcement in 2019 and this new Opinion builds on that work by looking at deployments outside of a law enforcement context, including for private sector surveillance and commercial use. It explains the robust assessments that organisations need to make before any deployment.

We welcome Parliament’s efforts over recent years in scrutinising the legal and ethical framework for the use of LFR. This includes considering the

Commissioner’s first Opinion and as part of the Committee’s work on the biometrics and forensics strategy review in a previous Parliament. We would welcome further deliberation on commercial use of this technology

and the potential implications for constituents and industry alike. We would also be pleased to respond to any questions you may have about the new Opinion.

Our interest in live facial recognition

Facial recognition relies on the use of people’s biometric data, which can be particularly sensitive and engages specific requirements under data protection law. Live facial recognition, often deployed in a similar way to CCTV, can involve the automatic and indiscriminate capture of biometric data from all individuals passing through a given location. There is often a lack of awareness, choice or

control for individuals in this process and LFR has the potential to be used in a privacy intrusive way.

In recent months, the Information Commissioner’s Office (ICO) has assessed and investigated the use of LFR outside of law enforcement, where controllers are using the technology for a wider range of purposes and in many different settings, notably in a surveillance context but also for commercial purposes. We have also been active on this topic via our international links with fellow regulators and with those engaged globally in the use of biometrics.

With any new technology, building public trust and confidence is essential to ensuring that its benefits can be realised. Given that LFR relies on the use of sensitive personal data, the public must have confidence that its use is lawful, fair, transparent and meets the other standards set out in data protection legislation. In the examples we have investigated and assessed to date, we have found that this has often not been the case.

It is important to note that it is not the role of the Commissioner to endorse or ban particular technologies. Rather, it is her role to explain how the existing legal framework applies to the use of personal data, to promote awareness of the risks and safeguards, and to enforce the law.

The Opinion published today sets out in detail the requirements of the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 (the DPA) and our regulatory approach on LFR. While it does not create legally enforceable obligations, it does provide detailed explanation of the ICO’s view on how the law applies in this context and our regulatory approach on LFR. In any future enforcement the ICO, while assessing each case on its own facts, may consider the Opinion, and its recommendations, in formal deliberations.

Next steps

The ICO will continue to progress active investigations in LFR and continue to provide feedback on data protection impact assessments that are submitted to us for review. We will take a proactive stance by conducting an audit of LFR

systems currently in deployment. The Opinion itself may be subject to iterative change in future as a result of further practical experience, material regulatory findings, or case law.

I hope this Opinion is helpful in providing consistent, clear, predictable regulation to those who might seek to use LFR. The ICO is open to any further engagement