GDPR Complaint Filed Against UK Facewatch, Partner
UK facial recognition company Facewatch and its partner, supermarket chain Southern Co-op, have been challenged by a 45-page complaint alleging their anti-shoplifter live facial recognition (LFR) system violates the UK GDPR.
UPDATE: this ICO complaint was closed in March 2023, effectively legalizing face recognition to catch shoplifters in the UK and with Facewatch touting this as a major win.
The complaint says the system is "unlawful and unfair" by failing to justify a 'substantial public interest' as required by the UK GDPR along with using poor signage and risking biased processing.
In a January 2022 investigation, IPVM highlighted the system's poor signage and GDPR risks. IPVM has also critically examined Facewatch's claim that catching shoplifters is in the substantial public interest.
Facewatch responded to the complaint by calling it "misleading, false and alarmist" and denying using "Chinese algorithms." The UK's data regulator now says it is "assessing the compliance of Facewatch".
In this post, IPVM examines the complaint and its potential impact.
System/UK **** **********
** ****, ******** **-**, **** ** the **'********-******* ******,************* ** ** ******* **** ****** recognition (***) ****** ** ****** ** England "**** ****** ****** ** *****" mostly ** *** ***********-********** ****.
*** ****** ** ******* ***********'* ****** *********** ******** *** ********* cameras. ************ *** *** '*********'** *********** ********, ******* *** **** for *** ***** ***** ***** ******** are ******* "** ***’** ***** **** stealing *****" (********* ***** *** *** stored).
******* ******, "*** **** ** ******** in ******** *** ** *** ** GDPR" *** "*** **********, ****** *** obligations ****** *** ****",*** *** ***.
Complaint *****
** **** **, ******* ****** ***** Big ******* **************** *** ***** ************ *** **'* **** ********** ******,*** ***, ******* **-** *** ********* **** the ****** ***** *** ******** ****** Carlo *** ****** ** *** ** the ***** ******* ** ***** **. (The ********* ********** *** *********** **** ****** *** *******.)
"Not ** *** *********** ****** ********"
*** ******* *****'***************** **** ******** *********** ** *** "necessary ** *************" *** ** ** "in *** *********** ****** ********".
******* *** *** ** **** **** ********** biometric **** ********** **** * *** key **********, ********* ** ** "** necessary *** ******* ** *********** ****** interest". ********* *** ****** ** **** standard ** ******* *** ******,*******"********* ** ********** **** ** * national ***** *** ** ************ ** reduce/prevent *****".
*******, **** ******* **** **** ***** on **** *********, ******* ******* ****** **** **** "***** *** ***** things **** ******* ***** ******* ****** recognition". **********, *** **** **** *** specify ******* **** *********** "*********** ****** interest", ******* ***** **** *** **************.
"Poor *******", "********** ***********"
**************** ******* **** *** *********/**-** ****** suffered **** "**** *******" *** "********** information ******":
******, *** **-** ************* **** **** *******. *** ** ****'******** ********* ****** *** * **** **** of ************ ** ** ********* ** signage, **** ** ******* ******* *** how ** **** * **** *******. However, **-**'* ****** **** *** * link ** ******* *******:
********* **** *** ** ***** ** the ******* ** *** ****** ***** were **** *** ********* ** ******:
**** ** *** ***** **** ***** obscured ** ******* ***** *****, *.*.:
**** *********** **** ***, ******** **-** **** *** *** signage "*** ***** *** *******".
Risk ** ****** **********
*** ***** ***** ********** ** **** the *** ****** ** "*** ****** the ***********'* ********** ************" *** ********* violates "*** ********* ** ********":
** **** ******* ******* **** "******** **** ***** ** processed ********, ****** *** ** * transparent ******". *** **** **** *** specify **** ** ***** ** "******", however,*** *** ********** "** ** *** ****** ** not ************ *********** ********* *** ************* accurate, ** *** **** ** ******* impacts *** ****** ********".
*** ******* *****'* ********* ******* **** Facewatch's ********** **** "*********** **** **** uploads **** ** ****** ** *** basis ** ************":
**************** **** ********* *** ******** **-** declined ** **** *** ******* ***** the *********** ** *** ********* *** how ***** *** ******* ** *** it, ******* ***** **** ********* ***** it.
ICO *** "********* *** **********" ** *********
** ********** *** *********, *** *** **** it ** "********* *** **********" ** Facewatch:
**** ***** ***** ** ************'* *******, ***** ******* ********* ********* and ******** **-** ** "****" *** "delete" *** "******** ********** ** ******** data":
Southern **-**: ****** "*********", ******** "******* *******"
******** **-** **** **** **** ********* defending *** ******, ****** ** "********* to ******* ******* *******":
** ***** ******* *** ************ ******** from *** *** ** ** **** our **************** ****** *** *** ** facial *********** ********* ********* *** **** hard ** ******* *** *********' ****** with *** **** ** ******* *** colleagues *** ********* **** ************ ******** and *****.
*** ****** ** *** ********** *** customers ** ********* *** **** ********** has **** * *********** ********** ** this, ** *** ******* ****** ** high **** ********* ***** ** ** being ****. ** **** ** **continues ** ******* ******* *******, **** ** ******* *** *** ** *********.
******* ** ** ******* ** *** relevant ****** ********* **** *** ****, inside *** ****, ****** *** ***** and ** ***** ***** *** ** periodically ****** **** ** ****** ** is ********* ** *** *** ************. With ****** *********** ***** **** * complex *****, *** ***** ********** ****** customers **** ********* ** ******* *** customer ******** ****. ***** ******** ** limited ** *** *****-*** *** ** facial ***********. ** ******** ** **** included ******** *********** ** **** **** guidance ** *** ******* ****** ********* on *** *******.
** **** ********* ********** ** ***** to ******** *** *****, *** **** with *** ****** *********** ********** ******** to ****** *** ****** *********** ****** is ****** *** ** **** *********. [emphasis *****]
**** *** ***** ******** **-** *** data ** *** ***** ********* ******* by *** ******; ** **** ****** if **** *******. ******: ******** **-** told **** **** *** *** *** contributed ** * "**% ********* ** violence ******* **********":
** *** ** ******* ****** ***** we ******** ****** ***********, ** **** seen * **% ********* ** ******** against ********** ** **** ******** ** 2020.
******* **-** *** *** ********* **** entirely ** *** ***, *******:
**** ********* ** * ********** ** a ***** ** ******** ** *** using ** ****** ***** ** **** as * ****** ** ******** *******.
Facewatch: "**********, *****, *** ********"
****************** * ******* *********** *** *******, **** *** **** Fisher ********** *** ******* *****'* *********** as "**********, *****, *** ********":
********* ** * ***** **** *** UK *********, *** ************* ******* *****, violence *** ****-****** ********* ******** ** is ********. *** ********* **** ****** to ** ***** ***** ******* ** crime ********** **** ** ****, ******, tagging *** ****** ******** **** ******. BBW *** ***misleading, ***** *** ******** information which is designed to create fear in the general public by demonising the use of facial recognition technology. For example, we do not share the faces of shoppers – only images of witnessed and evidenced offenders,nor ** ** *** ******* **********. Facial recognition is lawful for the purpose of crime prevention under the Data Protection Act if strict criteria are adhered to. Facewatch operates in full adherence with the law. Facewatch has always been open and collaborative with the ICO and welcomes any further constructive feedback from them as we take our responsibilities around the use of facial recognition extremely seriously. [emphasis added]
*******, *** *** *** ******* **** Facewatch **** "******* **********", ******* ******* out ********* *** ***** ****************. (********* ** ************, ********* **** ** ** "******** to *** ********").
**** *** ********* ******* **** ********* directly, *******, **** **** *** *** responded. ** **** **, ** **** update.
Impact ********
** ***, *** ** *** **** quite ******* **** ** ***** ** its ************** ** *** **** *** video ************, ******** ********* ** ******* systems ********* ** ********* ** ***** *** ***** **** countries (******* *** ******) ************ ** ****** * ****** **** fine *** ***** ************** ***.
*** ***'* ********** ** ********* ***** solidify **** ***** ** *** *** fails ** ****** *** ***** ** penalties. *******, ** ** **** ******** the ****, **** ***** ****** * shift ******* * ******** ************** ** the ****.
**** **** *** *** *******? *** many ********** ******** ******** ** **** vs ****? *** **** ********* **** 100 ********** *** **** **** ** 66 ** *** ** **** * to * **?
*********, * ** ********* ***** ***** without *** ******* ******* ** ***** obscure **** **** *** ******* **** very *** ******* ***** ****** ******* could **** * *** "***********" **********.
******, *** ********** ***** *****'* **** us ****; *'** ***** **-** *** raw **** ** **** ** ***** claims.
*** **-** ************ ********* "* ** afraid * ***'* **** **** ***********", I ********* **** **** **** ** and ****** ** **** **'* *********.
******: **** ***** *** **** ******** data, ****** "* **% ********* ** ******* ********* could ** * **** **** **** 3 ** * ******* ********* *** year". ** ********, ******** **-** ****** "* ***** ** *** **** **** one ****** ** ********, *** ***** see ****** ***********."
*** *** ******** *****:
******: ******** **-** **** **** **** there **** "**** **** **" ******* incidents ******* ********** ** **** *** those ** ******:
*** ****** ** ******** ***** ** violence ******* ********** ** **** ** these ** ****** *** **** **** 50. ******** ** ************, ** *** level, ** ** **** **'* ********* not ** ***** ** *** ****** of ******* ** ** ***** **** the **** **** ***** ******** *** an ****** ** **** ******'* ****, the ********** **** **** **** *** their ******** ***. ** **** ******** to *** * ***** ** ******** to ******* ***** ********* *** ******** in *** ******.
** ***** **** ** ********* ** 2020, * **% ********* ***** **** 33 ********* ** ****.
******: **** *** ************ ****** ** ***** ****, *********** ********** **** *********** ** catch *********** ** *** ** *** with **************** ****** * ***** ***.
********* ********* ** ******* *** *** some *********** ** ****, *** *** Brother ***** ******** ****** *****,*********:
- ********* ******* ** ** ********* ** a "***** **********"
- **** ****** ********* *** ** ******** in *********'* ********
- * **** ******* ******* ******
*** *** ******** ******** ********* ** well, ******* *** ****.
******: ******** **-** **** **** **** the *** *** *********** ** * "34% ********* ** ******** ******* **********":
******* **-** *** *** ********* **** entirely ** *** ***, *******: