Facial recognition technology has become an important subject in last several years, and especially in last few months. By virtue of surveillance and control aspect of it, there is a wide range area of use, such as shopping centers, airports, stadiums, concerts, and law enforcements.
Database of photographs, videos including identity card photographs, driver's licence photographs, security cameras, school card photographs and many other databases may be used by facial recognition technology to identify people in real life or security videos and photographs. The technology uses biometric data of human face to map facial features and assists to verify identity through key features of the human face.
Biometric data that facial recognition systems process is one of the special categories of personal data types which are numerus clauses according to the both Personal Data Protection Law1 ("Law"), main data protection legislation in Turkey and EU General Data Protection Regulation ("GDPR"), European Union's main personal data regulation. Either of the regulations mentioned-above defines special categories of personal data as a data category that is sensitive and in extreme need of special protection.
Article 6 of the Law prohibits to process special categories of personal data without obtaining the explicit consent of the data subject. But also regulates exception of this rule as only if any Turkish law permits processing of a special categories of personal data, it may be processed without obtaining the explicit consent of the data subject. Accordingly, there are two legal grounds to process a biometric data; obtaining data subject's explicit consent or finding a legal ground in a Turkish law.
Under GDPR, such processing of biometric data other than obtaining explicit consent of data subject may only take place on a limited number of grounds, the main one being for reasons of substantial public interest.
II. Practises and Discussions Around the World
While there are benefits of using the technology to prevent and solve crimes, there are many concerns about the data protection and privacy, safety and legislation regarding.
In January 2020, White Paper report on artificial intelligence draft has leaked before it has been published by European Commission. In the draft, Commission has stated that, use of facial recognition technologies in public areas might be banned for five years to develop a system that prevent the technology being abused2. Although Commission has revised its thought on ban in later drafts and eventually in the original report, still expressed that facial recognition is prone to inaccuracy, may be used to breach data protection and privacy laws, also may facilitate identity fraud3.
In France, the Administrative Court of Marseille ("Court") has made its first decision on facial recognition technology regarding it's use in French high schools4. The Court ruled against the installation of the technology, stating that its deployment violated the GDPR, as explicit consent students weren't obtained and technology was a disproportionate measure to manage the high school, especially with other alternative measures being available and less detrimental to students' rights.
United Kingdom is also one of the locations that there is an ongoing discussion. During Europe was having a debate over Whitepaper draft that considers banning facial recognition systems for five years, Metropolitan Police has started using automated facial recognition systems ("AFR") in February 2020. And places that may be referred to as crowded, chaotic and risky such as Oxford Circus5 which is very popular shopping district has been monitored by AFR since. Metropolitan Police made it's first arrest using AFR in London at the end of February. While police department announced it as a success6, dissenters questioned efficiency of AFR by emphasizing that it has scanned 8,600 faces to find if any matched a watchlist of more than 7,000 individuals, in the watch, Metropolitan Police has wrongly stopped five people and correctly stopped one. And recently, Equalities and Human Rights Commission has stated that mass AFR surveillance will constitute discriminatory and stifle free expression, which will start a new discussion7.
In January 2020, Facebook has settled a lawsuit which has been ongoing since 2015, alleges that Facebook collected biometric information in the form of face prints for the purpose of supporting its "face tagging" feature without obtaining the consent of its users, which violates the Illinois Biometric Information Privacy Act8. Facebook agreed to settle for 550 Million USD that constitutes the largest privacy settlement in U.S. history. This settlement is considered to have implications for all businesses using biometric identification techniques, such as facial recognition in U.S. As of now, states of California, Texas, Arkansas, New York and Washington have some form of state law that regulates biometric privacy, and more states are working on their legislations.
In China facial recognition systems are being used heavily for surveillance. Latest facial recognition news from there is that; a Chinese company has stated that they developed China's first facial recognition technology that has capability to identify people when they are wearing a mask9. And if a temperature sensor connection is provided, it can measure body temperature while identifying the person's name, and then the system would process the result, detects a temperature over 38 degrees. This way, the company aims to fight against Covid – 19 epidemic.
In another continent, India has been struggling with riots in New Delhi. According to the one of home minister's statement, law enforcement agencies has used facial recognition system to identify more than 1,000 individuals that allegedly took part in the riot10. Even though, there isn't any legal ground of using facial recognition technologies by governmental organizations in India yet, it's not the first time it has been used in the country.
As our daily lives continues to get more in control of technology systems, artificial intelligence and IoT's and usage of our biometric data will become more of a common practise, and maybe subject of many court decisions. As a growing market, facial recognition technology and systems are expected to become more stabilized in this process.
In Turkey, there isn't any current facial recognition technology discussion, practise or regulation yet. It's possible to use it with explicit consent according to the Law. In an international level, even it's highly a controversial topic as of today in many aspects, in accordance with increase in accuracy rate of the technology, law makers from around the world may regulate on usage of it in law enforcements and private matters.
1. Personal Data Protection Law numbered 6698 and dated 24.03.2016 has been published in the Official Gazette numbered 29677 and dated 07.04.2016.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.