A case brought by an individual, who argued his human right to privacy had been breached along with data protection law, by South Wales Police use of automated facial recognition, has been thrown out by the High Court stating that the Police had followed the rules and their use of facial recognition technology was lawful.
From a data protection perspective, whilst it was agreed that personal data was being processed, the police had acted in a lawful manner and as set out in the legislation. Essentially the GDPR angle is whether it is lawful for the police to use the technology and process it against a database of “known” individuals to spot potential “suspects”, where the images and the video footage would be personal data. Plus, as the cameras create a biometric profile of “faces in the crowd” for comparison with other information, the police will be processing special category data.
When processing biometric (for identification purposes) and other special category data the GDPR requires:
- A lawful basis for processing applies, plus
- A lawful condition for processing special category data
The case against South Wales Police were arguing that as well as the intrusive nature of the surveillance the subsequent processing of personal data was being done so without knowledge or consent by the individuals. However, the police do have powers in data protection law to process data in the public interest plus the Data Protection Act 2018 allows them to do so when it involves “The prevention, investigation detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security”.
The ICO, who are currently investigating the use of the technology by police forces, issued a statement:
“We will be reviewing the judgment carefully. We welcome the court’s finding that the police use of Live Facial Recognition (LFR) systems involves the processing of sensitive personal data of members of the public, requiring compliance with the Data Protection Act 2018. This new and intrusive technology has the potential, if used without the right privacy safeguards, to undermine rather than enhance confidence in the police.
“Our investigation into the first police pilots of this technology has recently finished. We will now consider the court’s findings in finalising our recommendations and guidance to police forces about how to plan, authorise and deploy any future LFR systems.
“In the meantime, any police forces or private organisations using these systems should be aware that existing data protection law and guidance still apply.”
So, we can expect more to come on this issue, not least of all if Mr Bridges (who brought the case with Liberty) appeals.
Providing cost-effective, simple to understand and practical GDPR and ePrivacy advice and guidance, via my one-stop-shop helpline. I ❤️ GDPR
