Facial Recognition Technology and Data Protection: How to comply?

From unlocking your iPhone and auto-tagging Facebook photos, to employers tracking productivity and police forces surveilling protests – facial recognition technology is becoming increasingly embedded into our everyday lives. Though its capability to enhance security, productivity, and convenience is indisputable, many concerns are raised about the privacy risks of such type of data processing, as well as its compliance with the privacy regulations.

Facial recognition technology uses cameras to capture videos and images and compares them to existing data in the database. If a newly captured image of an individual matches an existing image in the database, then the individual is identified.

These images are classified as biometric data, which is special-category data that is strictly prohibited to be processed under the recently adopted Serbian Law on Personal Data Protection.

By way of exception, the processing referred to the biometric data shall be permitted, in case that the person to whom the data relates to has given their explicit consent to the processing for one or more purposes of the processing. Such consent must be each freely given, specific, informed and unambiguous expression of the will of such person, by which such person, by a statement or by clear affirmative action, provides consent to the processing of personal data relating to them.
    
However, having in mind the general provisions of the Law on Personal Data Protection, it can be questionable whether this type of processing would be in compliance with the Law, even if the data controller obtains a consent from the data subject.
 
Two base principles of processing prescribed by the Law on Personal Data Protection are that the personal data must be (1) collected for specified, explicit, legitimate and lawful purposes and cannot be further processed in a manner that is incompatible with those purposes ("limitation relating to the purposes of processing") and (2) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimization").
 
Taking these principles into account, it can be concluded that the Law will permit the implementation of facial recognition technology only if it is used for a purpose which can`t be achieved in a less invasive way of data processing.

A similar position was taken by the Serbian DPA, in the several opinions given on the matter of processing of biometric data. Although the DPA has not yet rendered an opinion on the matter of facial recognition technology, in other similar cases of data processing, he took a stand that the processing of biometric personal data must be absolutely justified by the purpose and could only be used as a last resort. For example, giving opinion on the justification of using employees’ fingerprints for the purpose of monitoring the time spent at work, the DPA stated that this type of data processing is considered as an excessive processing for this purpose.

The same general principles of processing of biometric data are prescribed by the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, also known as Convention 108+, as the Serbian Law on Personal Data Protection, when it comes to this type of processing. The Council of Europe Consultative Committee of the Convention 108+ has adopted specific Guidelines for facial recognition, which state that the use of facial recognition technologies by private entities, according to Article 5 of Convention 108+, requires the express, specific, free and informed consent and consent of the subjects whose biometric data is processed.

To ensure that consent is given voluntarily, data subjects should be offered easy-to-use alternatives to using facial recognition technologies (for example, using a password or an identification badge), which also suggests that the justification of such data processing exists only on the condition that there is no less invasive alternative.

Lastly, the Law on Personal Data Protection also stipulates the obligation of Data Controllers to carry out an impact assessment before starting with the intended processing of biometric data, and, if necessary, obtain a preliminary opinion of the DPA. Thus, it is expected of private entities to require the DPA's prior approval and the justification of use of facial recognition technology for each purpose is dependent on the DPA’s opinion.

Although the current privacy regulation addresses the issue of facial recognition technology, the outlined principles are vaguely defined and can be interpreted from different angles. Therefore, the use of facial recognition technology will inevitably be met with some skepticism. But when it comes to personal data processing and compliance issues of implementing new technologies, the conversation between Data Controllers and legal authorities is crucial.

Article provided by INPLP member: Sonja Stojčić (Živković Samardžić, Serbia)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)