Our client is an anonymous individual based in the UK.
Live automated facial recognition (’LFR’) technology is increasingly used in our public spaces in the UK. It allows individuals held on a ‘watchlist’ to be instantly identified when they come in range of a CCTV camera.
Much debate has focused on the use of this technology by police to apprehend suspects wanted for arrest. But it has also become increasingly used on our high streets by private companies such as The Cooperative and Home Bargains. These companies use LFR provider Facewatch Ltd to create their own watchlists of individuals they do not want in their stores. Individuals are recorded as being suspected criminals without any involvement from the authorities, and can find themselves banned from a wide range of stores, enforced through instant-recognition LFR cameras.
Despite being marketed as scientifically objective, these systems can often make mistakes, with ordinary people left as collateral damage from large companies’ efforts to automate security.
Our client was misidentified by an LFR system used by Home Bargains, provided by Facewatch. She was falsely accused of theft in public and escorted from a store, causing her significant distress. We were instructed to bring a complaint to the data protection regulator - the ICO - for confirmation that her rights had been breached, and to obtain information about the LFR system which had been withheld by the companies involved.
The complaint
-
Detailed complaint to the regulator
We submitted a detailed complaint to the ICO on our client’s behalf, drawing on our extensive experience analysing Facewatch’s system against the requirements of the UK GDPR.
-
Complex issues
Due to the conduct of the data controllers, this complaint had to address complex issues, including:
- A refusal by the store using the equipment to acknowledge that it had any controller responsibility for processing our client’s data.
- Novel arguments regarding the required standard of accuracy in the use of LFR - i.e. whether ‘false positive’ misidentification can be a GDPR breach.
- The apparently deliberate deletion of relevant information by Facewatch in response to our client’s data subject access request.
-
Successful outcome
Our client’s complaint was upheld by the regulator. This is the first time of which we are aware that the ICO has upheld a complaint about Facewatch’s LFR system. Notably, the ICO’s decision confirms that clients of Facewatch are data controllers for their processing of biometric data, and therefore must comply themselves with the requirements of the GDPR. It also shows that LFR misidentification can be a breach of the accuracy principle in the GDPR, which could give rise to complaints or civil claims from other individuals facing the same situation.
This outcome has not only provided vindication to our client but has ensured that she will receive access to information about the system which affected her which was improperly withheld by the companies.