Guidelines EDPB 05/2022 on the use of facial recognition technology in the area of law enforcement

ID 16673 | 23.05.2023

Version 2.0 - Adopted on 26 April 2023

More and more law enforcement authorities (LEAs) apply or intend to apply facial recognition technology (FRT). It may be used to authenticate or to identify a person and can be applied on videos (e.g. CCTV) or photographs. It may be used for various purposes, including to search for persons in police watch lists or to monitor a person’s movements in the public space.

FRT is built on the processing of biometric data, therefore, it encompasses the processing of special categories of personal data. Often, FRT uses components of artificial intelligence (AI) or machine learning (ML). While this enables large scale data processing, it also induces the risk of discrimination and false results. FRT may be used in controlled 1:1 situations, but also on huge crowds and important transport hubs.

FRT is a sensitive tool for LEAs. LEAs are executive authorities and have sovereign powers. FRT is prone to interfere with fundamental rights – also beyond the right to protection of personal data – and is able to affect our social and democratic political stability.

For personal data protection in the law enforcement context, the requirements of the LEDhave to be met. A certain framework regarding the use of FRT is provided for in the LED, in particular Article 3(13) LED (term “biometric data”), Article 4 (principles relating to processing of personal data), Article 8 (lawfulness of processing), Article 10 (processing of special categories of personal data) and Article 11 LED (automated individual decision-making).

Several other fundamental rights may be affected by the application of FRT as well. Hence, the EU Charter of Fundamental Rights (“the Charter”) is essential for the interpretation of the LED, in particular the right to protection of personal data of Article 8 of the Charter, but also the right to privacy laid down in Article 7 of the Charter.

Legislative measures that serve as a legal basis for the processing of personal data directly interfere with the rights guaranteed by Articles 7 and 8 of the Charter. The processing of biometric data under all circumstances constitutes a serious interference in itself. This does not depend on the outcome, e.g. a positive matching. Any limitation to the exercise of fundamental rights and freedoms must be provided for by law and respect the essence of those rights and freedoms.

The legal basis must be sufficiently clear in its terms to give citizens an adequate indication of conditions and circumstances in which authorities are empowered to resort to any measures of collection of data and secret surveillance. A mere transposition into domestic law of the general clause in Article 10 LED would lack precision and foreseeability.

Before the national legislator creates a new legal basis for any form of processing of biometric data using facial recognition, the competent data protection supervisory authority should be consulted. Legislative measures have to be appropriate for attaining the legitimate objectives pursued by the legislation at issue. An objective of general interest – however fundamental it may be – does not, in itself, justify a limitation to a fundamental right. Legislative measures should differentiate and target those persons covered by it in the light of the objective, e.g. fighting specific serious crime. If the measure covers all persons in a general manner without such differentiation, limitation or exception, it intensifies the interference. It also intensifies the interference if the data processing covers a significant part of the population.

...

Fonte: EDPB

Collegati