Facial recognition in supermarkets: it has advantages, but there are also disadvantages and privacy risks. The Dutch privacy supervisor sent a formal warning to a Dutch supermarket because of its use of facial recognition. When are you allowed to apply facial recognition, and is it out of sight for supermarkets? IT lawyer I Chu Chao takes a closer look at this question in two blog articles.
In part 1: What is facial recognition and what are the risks?
Facial recognition is already widely used
Face recognition; it sounds like science fiction, but in reality, facial recognition is used more often than you know. Think of the smartphone users who can unlock their phone ‘with their face’. You can tag your friends in photos on Facebook, or make a ‘face swap’ in popular apps such as Reface and the ‘face aging app’ FaceApp.
Facial recognition is an application of artificial intelligence (‘AI’). These are systems that show some “intelligent behavior” by analyzing its environment and taking actions to achieve certain goals.
AI-based systems can be fully software-based and operate in the virtual world, such as voice-activated assistants, image analysis, search engines, voice and facial recognition. They can also be incorporated into hardware, for example in advanced robots, autonomous vehicles, drones or Internet of Things (IoT) applications.
Applications of facial recognition
There are several applications of facial recognition, for different purposes:
- Identification: identifying persons based on digital recordings from an existing database of facial profiles;
- Verification: the 1-on-1 comparison of facial profiles to determine whether a person is the ‘right’ person;
- Matching: comparing images with other images to match photos of people, for example for tagging people on social media;
- Categorization: detecting characteristics to categorize people, for example whether someone is young or old; and
- Emotion classification: detecting emotions, e.g. whether someone is happy or angry.
Facial recognition in retail
Facial recognition can be interesting for the retail sector. For example, facial recognition can be used to prevent shoplifting, to send text messages with offers to shoppers, or to pay for your groceries without a checkout counter.
In the Netherlands, a supermarket installed a system with 80 cameras that can capture faces of visitors. These images are ‘matched’ with face images of people who have a shopping ban.
The Dutch Data Protection Authority (“Autoriteit Persoonsgegevens” or “AP”) was not happy with this. The AP sent a letter to the supermarket trade association (CBL) with the rules about the application of facial recognition. The regulator also sent a formal warning to the supermarket in question.
Advantages of facial recognition in supermarkets
The use of facial recognition can have advantages for a supermarket. It requires a large initial investment, but it can be cost-effective if fewer store staff or security guards are needed to enforce shopping bans. The objectives of the supermarket were:
- the protection of shoppers and staff; and
- prevention of shoplifting.
Disadvantages and risks of facial recognition
There are also disadvantages and risks associated with facial recognition. Abuse of stolen images is a risk. On the ‘dark web’, you can buy facial images and location data of unsuspecting people, for as little as 175 Euros.
The use of ‘harmless’ facial recognition applications, such as the ‘face-swap’ app ‘Reface’, can have unforeseeable consequences. This app applies a certain machine learning technology (generative adversarial network or ‘GAN’) that (partially) replaces existing images of people with other images of another person; this is also known as ‘deep fake AI’. Criminologists now see ‘deep fake AI’ as one of the greatest technological threats to humanity, even more so than ‘killer robots’.
In case of abuse, ‘deep fake AI’ can potentially cause great harm to people, for example when manipulating pornographic images. Deep fake AI may potentially be used to influence elections or cause social unrest, e.g. by falsifying speeches.
Another disadvantage of facial recognition systems is that they are easy to deceive. A few examples are: by shining with a laser (to confuse the cameras), applying asymmetrical makeup to your face, or wearing sweaters (or face masks) with different facial patterns printed on them.
Official warning to supermarkets
In the Netherlands, facial recognition technology has been used for several years, for example at Schiphol Airport, or in Amsterdam around football stadium Johan Cruijff Arena. These applications of facial recognition have a strong link with police enforcement in the public space.
The application of facial recognition by businesses (such as supermarkets) is on the rise. This development is viewed with suspicion by the Dutch privacy authority (AP), which issued an official warning to the supermarket sector. This raises the question: are supermarkets allowed to use facial recognition, or is this out of reach?
If it were up to the privacy authority AP, facial recognition may only be used if permission has been given by all people, which seems unrealistic to me, or for the security of nuclear power plants, which is very limited.
So the bar is set high, probably too high for supermarkets. The AP does not consider the security of supermarkets important enough for the use of biometric data for facial recognition. In practice, this makes it impossible for supermarkets to use facial recognition. The question is whether this ‘prohibition’ will hold, from a legal point of view.
Go to part 2: Legal analysis of facial recognition in supermarkets.
Would you like to know more about the legal aspects of facial recognition? Send me a message via the contact page.