EDPB adopts the final version of Guidelines on facial recognition technology in the area of law enforcement
Reading Time: 3 minutes
Authors:
Trilateral Research |
Date: 27 June 2023
Introduction
On May 17, 2023, the European Data Protection Board (EDPB) adopted the final version of its Guidelines on the implementation and use of facial recognition technologies (FRT). The FRT guidelines finalised are applicable to law enforcement agencies (LEAs), their officers, and legislators at the EU and EU Member State levels.
This article delves into the legal considerations to be undertaken by LEAs when deploying FRTs. Then the article will consider certain scenarios to illustrate complaint vs non complaint use of FRTs against the EU law. Lastly, we have also listed essential data protection recommendations as stated by the EPDB in this context.
Background
FRTs are a billion-dollar industry, and by 2024, it is expected that 1.3 billion gadgets will use this technology. The use of FRTs by governmental authorities for purposes of counterterrorism and public safety, however, is the biggest concern. After a period of public consultation, the FRT guidelines were updated and revised to include further clarifications.
Elements to be considered by LEAs when deploying FRTs
The EDPB stated that any use of FRT technologies must be in compliance with the Law Enforcement Directive 2016/680 (the "Directive") and the EU Charter of Fundamental Rights (the "Charter"). It stated that the compliance is particularly essential in the area of law enforcement and criminal justice. The EDPB also states certain non-exhaustive considerations that must be assessed when implementing legislation concerning FRTs on a case-by-case basis. Some of the fundamental considerations are as follows:
- The use of FRTs and its corresponding impact on the rights of a data subject mentioned in Article 7 (right to private life) and Article 8 (right to protection of personal data) of the Charter.
- The necessity and proportionality of the impact caused thereby limiting the above-mentioned rights in accordance with Article 52 of the Charter.
- Processing of personal data must be in accordance with EU or Member State law as per Article 8 and 10 of the Directive.
- Clarity provided by national law giving data subjects adequate indication of circumstances or conditions (legislative basis) under which controllers may resort to the use of FRTs as stated in recital 33 of the Directive.
- Purposes and the interaction between face recognition technology and the laws governing automated decision-making.
Key Takeaway from the Guidelines
The EDPBs request to impose a prohibition on the use of FRTs remains constant when compared to the EDPB-EDPS joint opinion. However, in FRT guidelines the EDPB lists certain complaint and non-compliant scenarios concerning the use of FRTs that have been listed below:
Compliant with EU law | Non-Complaint with EU law |
Automated border control system enabling border passage by authenticating biometric images stored in the electronic travel documents of EU citizens. | AI-supported FRTs categorising individuals based on their biometrics into clusters according to ethnicity, gender, as well as political or sexual orientation or other grounds for discrimination. |
Systems for picture comparisons of people identified as suspects by LEAs in riots and other related instances. | Processing of personal data in a law enforcement context that would rely on a database populated by collection of personal data on a mass-scale and in an indiscriminate way, e.g., by "scraping" photographs and facial pictures accessible online. |
Use of real time remote biometric identification in a specific area (based on intelligence), where the LEAs decides when, where and for how long to deploy the FRT. | Remote biometric identification of individuals in publicly accessible spaces. |
Systems to locate abducted children. | Use of FRTs to infer emotions of a natural person. |
Recommendations listed in the Guidelines
The FRT guidelines mention several technical and organisational measures that may assist the LEAs in the management of FRT projects. We have listed a few measures that if adopted from a data protection perspective will boost compliance:
- Undertake a data protection by design and default approach prior to commencing the procurement of the FRT system.
- Conduct a Data Protection Impact Assessment (DPIA) as the use of FRTs by LEAs will pose a significant risk to people's rights and freedoms.
- Continuously update the processing activities as stated in the Record of Processing Activities maintained by the LEA.
- Implement necessary policies, procedures, security standards and controls to ensure that neither the FRTs nor the personal information it collects is subject to unauthorised access, misuse, or loss.
- Make sure to have a standard procedure in place to deal with data breaches involving biometric data. The DPO must be immediately informed along with the affected data subjects.
Conclusion
Through this article we have considered the legal considerations for the LEAs to follow and made clear the compliant and non-complaint processing activities for the LEAs to consider when deciding to deploy FRTs. By following the above-mentioned list of recommendations any LEA can ensure baseline data protection compliance at inception stage of the project dealing with FRTs.
At Trilateral Research, we have a team of experts that can help with measures related to the deployment of FRTs. With respect to data protection compliance, please connect with our Data Protection and Cyber-risk team. We also have a Responsible AI team which can help with the assessment of FRTs during deployment and other AI-related issues. Please do not hesitate to contact a member of Trilateral Research, we will be happy to assist you in full.
