Facial recognition technology and law
📘 Overview: Facial Recognition Technology & the Law
Facial Recognition Technology (FRT) is used to identify or verify individuals using biometric patterns derived from facial features. It has been implemented in areas like policing, border control, public surveillance, and even commercial applications (e.g., retail, banking).
⚖️ Key Legal Concerns Involving FRT
Privacy and Data Protection
FRT processes biometric data, which is considered sensitive personal data under laws like the EU’s General Data Protection Regulation (GDPR).
Consent and Transparency
Individuals often are not aware they are being scanned, raising issues of informed consent.
Proportionality and Necessity
Is the use of FRT proportionate to the aim pursued (e.g., crime prevention)?
Surveillance and Chilling Effects
FRT can enable mass surveillance, discouraging free expression and public assembly.
Bias and Discrimination
FRT algorithms have been shown to have racial, gender, and age-related biases.
🧑⚖️ Case Law Examples: Detailed Explanations
1. European Court of Human Rights (ECtHR) – S. and Marper v. United Kingdom, 2008
Issue:
Although not directly about FRT, this case laid the foundation for biometric data privacy in Europe.
Facts:
Two individuals challenged the retention of their fingerprints and DNA by the police, arguing it violated their privacy.
Legal Relevance to FRT:
The Court recognized biometric data as extremely sensitive and part of one's private life.
Any retention or use of biometric data must be justified, necessary, and proportionate.
Impact:
This case shaped later case law regarding FRT by establishing that indiscriminate biometric data collection breaches Article 8 of the European Convention on Human Rights (Right to Privacy).
2. Supreme Administrative Court of Finland – Case KHO:2020:42 (FRT in School Monitoring)
Facts:
A Finnish upper secondary school used facial recognition to track student attendance.
Issue:
Whether the use of FRT for this purpose violated the GDPR and Finnish Data Protection Act.
Court’s Findings:
The processing of facial images constituted biometric data, requiring explicit consent.
In this case, the students (minors) were not capable of giving valid, informed consent, especially due to a power imbalance.
The school failed to provide alternatives, making the consent not freely given.
Outcome:
The system was deemed illegal; the school was ordered to discontinue use.
Significance:
Reinforces that even seemingly benign uses of FRT (like in education) can violate data protection laws.
3. UK Court of Appeal – R (Bridges) v. South Wales Police, 2020
Facts:
Police in South Wales used live facial recognition in public places to identify people on watchlists.
Issue:
Whether such use of FRT without statutory authorization was legal.
Court’s Ruling:
The use infringed privacy rights under Article 8 of the ECHR.
There was no clear legal framework guiding how FRT should be used.
The police failed to assess the technology’s impact on rights, including risks of bias.
Outcome:
The use of live FRT was ruled unlawful.
Significance:
One of the first appellate-level rulings in Europe to declare police use of FRT unconstitutional due to lack of safeguards.
4. CNIL (France) Decision – Facial Recognition in High Schools, 2020
Facts:
Two high schools in the Provence-Alpes-Côte d'Azur region used FRT to control student entry.
Legal Body:
French Data Protection Authority (CNIL)
Findings:
The use of FRT was not proportionate to the aim (security and efficiency).
Schools could have used less invasive alternatives, like ID cards.
Since education is a public service, there’s a power imbalance making consent invalid.
Outcome:
CNIL ordered the schools to stop using the technology.
Significance:
Demonstrates regulatory enforcement against normalizing biometric surveillance in schools.
5. Sweden – Data Protection Authority Case (2020) – FRT in Schools
Facts:
A Swedish school used FRT to monitor attendance, scanning students as they entered classrooms.
Issue:
Was this consistent with the GDPR?
Findings:
The use was ruled unlawful because the legal basis of consent was invalid.
The school failed to perform a Data Protection Impact Assessment (DPIA).
The system was intrusive, and less invasive means existed.
Outcome:
A fine was imposed on the school.
Significance:
One of the first fines under GDPR for biometric data misuse in education.
6. Germany – Bavarian Data Protection Case (2021) – FRT in Shopping Mall
Facts:
A shopping center used facial recognition to track "undesirable customers" (e.g., suspected shoplifters) entering the premises.
Issue:
Whether such profiling and surveillance violated GDPR.
Findings:
Processing special category data without a valid legal basis.
No DPIA was conducted.
Customers were not informed, violating transparency principles.
Outcome:
The Bavarian DPA ordered the deletion of data and issued a warning.
Significance:
Shows the risks of using FRT in private-public commercial spaces without adequate safeguards.
7. European Court of Human Rights – Bărbulescu v. Romania, 2017 (Related Precedent)
Facts:
An employee was monitored at work without his knowledge.
Connection to FRT:
The Court ruled that surveillance must be transparent, proportionate, and necessary.
In context of FRT, covert surveillance using facial recognition would likely breach this standard.
🛡️ Legal Safeguards for Facial Recognition
| Legal Principle | Explanation |
|---|---|
| Explicit Consent | Required for processing biometric data (unless an exemption applies). |
| Proportionality | The use of FRT must be necessary and balanced with fundamental rights. |
| Transparency | Individuals must be informed when FRT is used. |
| Legal Basis | There must be clear legal authority allowing the use of FRT. |
| Data Protection Impact Assessment (DPIA) | Required before deploying high-risk technologies like FRT. |
| Bias and Equality Review | FRT must be tested for racial, gender, and age-related biases. |
👁️ Conclusion
Facial Recognition Technology raises complex and often controversial legal issues, especially when used by public bodies, law enforcement, or educational institutions. Courts and data protection authorities across Europe have consistently ruled that improper use of FRT violates privacy, equality, and transparency rights.
The general trend in case law is against indiscriminate or covert use of FRT without:
A clear legal framework
Strong privacy protections
Human oversight
Accountability mechanisms
RELATED Blog
0 comments