If holding a photograph is permitted can a company use facial recognition?

Question

If I've given a company permission to hold an image of me - for a photo ID card, for example. Do they need any extra permissions to use facial recognition software?

The facial recognition software need only use the reference photograph I've already given them permission to and any CCTV is already recording all visitors/customers anyway.

As a little background as to why I wondered about the legal issues behind this:

There is plenty of regulation around other methods of identification ( see Protection of Freedoms act which covers fingerprints and DNA), with facial recognition being an automated, silent version of these forms of identification it made me wonder if any similar regulations covered the use of photographs.

Edit: Initially I was only interested in the UK but I would be interested to hear about regulations within other countries

Answer 1

The company would likely require explicit consent for using facial recognition algorithms.

The GPDR considers certain activities to be processing of “special categories” of personal data (Art 9 GDPR). One of these categories is “biometric data for the purpose of uniquely identifying a natural person”. Such processing activities are prohibited unless an exception applies.

Facial recognition uses biometrics to identify a person, so it's prohibited by default.

There are, of course, many exceptions. Art 9(2) GDPR contains a list of general exceptions which allow special categories data to be processed. In UK law, specific conditions for these situations are given in Schedule 1 of the Data Protection Act 2018. Whether any exception could apply depends a lot on the purpose for applying facial recognition, e.g. if it is necessary in a medical context or if it is truly necessary in an employment context.

The most interesting exception in the context of video surveillance would be Art 9(2)(f):

processing is necessary for the establishment, exercise or defence of legal claims

However, necessity is a fairly high bar to clear. This exception cannot be used to pre-emptively scan a database of images in the hopes that it might find something. In contrast, it might be permissible to use facial recognition to confirm a suspicion. But here, there's a big caveat in that most facial recognition software cannot provide reliable results for less than ideal pictures (i.e. anything other than a well-lit frontal portrait of the face), and that such software is known to produce biased results. Thus, the use of facial recognition by private companies is still questionable.

If none of the exemptions in the GDPR/DPA clearly applies, then only the Art 9(2)(a) exception is left over:

the data subject has given explicit consent to the processing of those personal data for one or more specified purposes

A notable example of a company illegally performing facial recognition is Clearview AI. Multiple data protection authorities have announced fines, including the UK's ICO: in late 2021, the ICO announced the intent to issue a GBP 17M fine for, among other things, failing to meet the higher data protection standards required for biometric data.

This answer applies to private-sector data controllers, i.e. ordinary companies. Different rules can apply in the public sector, in particular for law enforcement agencies.

Answer 2

That would depend on what license or permissions you gave the company when you gave permission to "hold" the photo.

I am not aware of any law which would require explicit permission for the company to run such an image through facial recognition software, but I would think if the image were provided with an explicit restriction preventing this, that would be binding.

Since the question is tagged for the UK, the GDPR-UK applies. As pointed out in the comments by Trish, and in the answer by Amon, Article 9 paragraph (1) of the GDPR specifically prohibits the processing of "biometric data for the purpose of uniquely identifying a natural person" unless one of the listed exceptions apply. The most plausible exception is that in paragraph (2) point (a):

The data subject has given explicit consent to the processing of those personal data for one or more specified purposes.

If such consent has not been given, one of the other listed exceptions in paragraph 2 (summerized in the answer by Amon) must apply. If no exception applies, it is prohibited for a private company to process such data, which includes simply storing it.

A photograph intended for use by facial recognition software is certainly biometric data to which GDPR 9(1) applies.

Thus unless the Data Subject (you in this case) consents, the company may not even store the photo, unless one of the other listed exceptions applies.