UK Grocer Facial Recognition With Hikvision Cameras, GDPR And Ethical Risks Examined

Published Jan 17, 2022 10:02 AM

A UK grocery chain known for touting its ethical practices is running a live facial recognition (LFR) system across dozens of locations with tiny/often obscured signs and Hikvision cameras, sparking GDPR and ethics concerns.

IPVM Image

The Mail on Sunday ran an article based on IPVM's investigation: Co-op supermarkets are using facial recognition cameras made by Chinese state-owned company 'to track its shoppers'

Executive Summary

IPVM photographed nine Southern Co-op stores with LFR, finding one with no signage viewable by entrants at all, while seven had small and often obscured signage. In contrast, the UK's data regulator says LFR should include "prominent signage" that is "clearly visible" and viewed "before" people enter covered areas. This system is also powered by Hikvision cameras, raising ethics concerns over the firm's extensive Xinjiang involvement.

** ********, ******** **-** **** **** it *** "***** *** **** *******" at * ***** *** ******** **, adding **** ******* "** ******* ***** signage", ********* *** ******'* "**% ********"; however **-** *** *** ******* ** IPVM's ********* ***** ********* ** ******* more ******** **** ** *** ******'* performance/accuracy.

** ****** *********** **** *********, ***** runs *** *** ******, *** *** respond ** ****'* ******* ********. ******** to ****'* ********, ******* ************ *** Brother ***** **** *** ***, *** UK's **** *********, "****** ******** **** a **** ******** *************" **** *** system ***** ** ****** "********, ********* and ****-***** ******".

System **********

** ********, ******** **-**, * ****** of **-** (*** **'********-******* ****** ******** ********** ~$**.* *******),************* ** ** ******* *** ****** 35 ****** ** ******* "**** ****** levels ** *****". **-** ** ***** in *** ** *** ******* ******, what ** ***** "*** **-** **********", *.*. **************** ************* ********** ***************-***** ** *** ************* ********** *********** (*.*. *****).IPVM Image

** * ********* ** ****** *****, director ** ******* ******** *** ******* Watch, ******** **-** ********** *** ** specific ****** **** ***, ****** ** the ***********-********** ***** ****. *** ******* Watch *** ****************** **-** ** **** *** ****** over *** ******* *****.

Facewatch **********

IPVM Image

*** ****** *********** ****** ** ******* by *********, * ** **** ****** recognition ******* ***** ***** ******* ********* catch ***********.********* ****** ***** * **** ******** ** "Subjects ** ********" *** ****** ***** time * ******** **** ****** * store. ******** ***** ***** ***'* ***** the ******** **** ***** **** "******* instantly"; *** ***** *** **** *** 2 *****. **** *****************'* **** ************ ****.

Southern **-** **** "*********** *******", "****** ****** *****"

******** **-** **** ********** ******* ****** Lewis********* ** *********'* *********** *** *** *** "*********** *******" and "*** ****** ****** ***** ** the ****** ***** ** ** ********":

IPVM Image

** ** **** ** *** **** prevention *** ******** *******, * **** found **** ****** *********** ** *** such ********** **** ***helped ****** ***** in the stores where it is deployed. We have completed a successful trial using Facewatch FR in a select number of stores where there is a higher level of crime. All of our customers have been made aware with distinctive ******* and we have introduced a system which does not store images of our customers unless they have been identified in relation to a crime.

**** ********* ******** **** ***** *** effectiveness ** ******** **-**'* ****** *** Co-op ****'* ******* ** **** *****.

IPVM *********** *********

**** ***** ************ ****************** ******** **** ****** ** **** ** the ******** **-** ************ ********* ** have ****** *********** ** *** ***********-********** area. *** ****** ******** ** **** were ******** ********.

IPVM Image

What *** *** **** ***** *******

*** **'* ****/**** *********, *** ***,****** ** * **** ********** ****** ****** (********* *****) ***** LFR ****** **** ***** **** *** "prominent", "******* *******", *** **********" ** the ******:

IPVM Image

*** *** **** ********** **** *** signage ****** ** ****** "******" ******* of *** ****** "***** *** **** covered" ** ***. *** **** ** GDPR **********, ********'* **** *** ***** ************ *****.

Key ********

** ***** ** **** **********, **** found ******* *****:

  • *** ******** **-** ***** ****** *********** had ** ********** ** ******** **** LFR *** ** ***. **** **** against***** *** ************ ******* ****** ** ****** "******" members ** *** ****** "***** *** area *******" ** *** ***** **** disclosure ************** *** ****'* ******* **.
  • ***** ****** ***** *** *** ****, hard-to-notice ******** ***** ******** ** ******* doors. **** ************** ************ *** ****** ******* "********* *******" that ** "******* *******" *** "**********".
  • *** *** ****** *** ****** ******* disclosing *** *** ***** **** ******** a **** ** ******** **-**'***** *******. ******** **-**'* **** ***************** *********** ************ ************ **** ******* ******* *** data ********.

*** ******'* ********* ***** **** ***** ethical *** ******** ******** *****:

  • ********* ************ *** *************** **********: ** ** ********* ********* and ********* **** ***** ******** ****** projects ***** ~$*** ******* *** **** it *** ~*** ***** ***** ** November ****. *********'* ******* ********************* **** ********* ******** ************* ***** in ****.
  • ******** ***** *** ** ***** ************ on ********* ** *** **, * UK ********** ********* *** (** *** unsuccessfully) ****** ************ ** ** ****** ** *** UK**** *** ******** ***********. ********* ***** ******* ** ******* **'* ************ ****** ************ ***** its ******** ********** ****** ** ******.
  • *** ** ******** ** ******* ********"** *** ** *** / ******* Hikvision"**** *********** ******** ******** ********;********* ** ******* *** ************ *** *** **********.

Southern **-** ********

**** **** *** ******** ** ******** Co-op, ***** ********* *****:

IPVM Image*** ******* *** ******** *** ** this ********** ** **** ***** ***** is * **** ***** ** *****. It *** ******* *** ********** ** identify **** * ***** ****** ******** enters *** ** *** ****** *** has ***** **** *** **** ** decide ** *** ****** ******, ** delivering ******** ******* ** '*****' ********, thereby ********** ***** **** ****** ***** and ******** * ******** *** ********. Where **** ** ** ***, ** provide ***** ******* ********** *** *****.

  • ** **** ***+ ****** *** **** this ** ** ****** ***** ***** is * ****** ***** ** *****. We **** ** ***** ** ******* to ******* **** **** *** ** more ******.
  • ******* ** ** ******* ** *** relevant ****** ********* **** *** ****, inside *** ****, ****** *** ***** and ** ***** ***** *** ** periodically ****** ** ****** **** ** displayed ** *** *** ************.
  • **** ****** ** *********** ********* ** have ********* ** ******* ** *** store, ********* ***** *** **** **** banned/excluded, *** **** ** *** ****** recognition ********.
  • *** ****** *********** ********** **** ** use *** * **% ******** **** - ** *** *** **** ******** facial *********** ********** ** *** ****** as ****** ************* ** **** (******** Institute ** ********* *** **********). ***** is **** * ***** ********** ** the *****.
  • *** ****** ** **** ********* *** does *** ***** ****** ** ** individual ****** **** **** **** ********** and ********* ** * ****** ********.

******** **-** ******* *** **** *********** algorithm ** "*** **** ********" ** "ranked ************* ** ****", *** **** is *********** ****** **************** ******** ********* ********** ****** ******** different ***** ** *****. ******** **-**/********* have *** ******** ********* ***** *********'* name *** ***** ******** ** ******** on.

** **** *** *********, ** ******* ** ****** ** 'GDPR *********' ***** ***** ** ** official **** ************* **** *** ********* with *** **** ** ** ******* process. *********'* **** ********** *********** ************* * ** ******* ****** ****** the **** *****.

Southern **-** ******** ******* *******

******** **-** **** ** *** "********" a **** **** **** ******* ** a ***** ** ********** (**** ********** one ********** *****, *** ****, **** no *** ********** ** ******** ** all):

****** ******** ******** *** ******* ** our *****, ** ***** *** **** missing ** * ***** ** **********. This *** *** **** ********. *** other **** ******* *** ***** *** correct ********* **** *** ****, ****** the ****, ****** *** ***** *** on ***** *****.

***** **** ********, **** **-******* *** Hard's ******** **-** ** ********** *** confirmed **** *** ********* ******* ** on *******:

IPVM Image

One **** *** ****** *** ****

******** **-** **** **** *** ****** had *** *** ****** *** ****:

** **** *** ****** *********** ****** per **** *** *** ********** **** we *** *** * **% ******** rate. ** ****** ****** *** ****** with *** ****** ** **** *** other ************.

*******, ** **** ** *** ****** IPVM ******* *** ** *********** ***** to ******************* *** ***** *** ****** ***********.

No ******** ** *********, ****** *********** ****

******** **-** *** *** ******* ** IPVM's ********* ***** ****** ******** *********** Hikvision. **** **** ***** *** ******** data ** *** **** *******/************* **** been **** ****** ** *** ******; Southern **-** *** *** ******* ******** to ***** ********, ******* ********* **** their *** ****** ** "******* *** targeted":

IPVM Image

*** ******* ** *** ******* *** targeted *** ** ****** *********** ** to ******** **** * ***** ****** offender ****** *** ** *** ******. We *** * *********** ** ****** recognition ********** *** ***** ************.

** * ****** ***** ***** ***** place **** ***** *****, ***** *** flagged ** ** ***** ** *** store/duty ******* *** **** ********* ** a ********* ** *****. '** *****' images *** ****************** **** *** ******. **** * match ** ******** ** ******, *** colleagues *** **** ** *** ******** service *** '***** ********' ** ***** any ******** **** ****** *****, ** to ******** *** ******** ** ***********, for *******, ** *** ********* ***** on ** *** ******** ** ** breach ** ** ********** ** ******* Order.

*** ******** *** ***** ***** ** our ********** ** ********* *** ************. We **** *** *********' ****** ********* seriously *** **** ****** **** ** balance ***** **** *** ***** **** to ******* *** ***** **********, *** any ********* *******, **** ***** ********* attacks.

97% ******** ****** ********

**** **** ***** ******** **-** *** it ******* ** *** **% ******** figure (*.*. ***** ******** *** ***** negative *****) *** ******* **** ******** still ******* *** ****** ******* ***** and *******. **-** *** *** ******* specific **** *** ****** ***** ** reduce ******** "********", *******, "*** *** matches *** ******** ** ******":

*** ********** ******** ** ******** ******* with **** ********* *** *** *** matches *** ******** ** ****** **** any '** *****' ****** *********** ******* from *** ******.

****'* ******** **** ******** **** ********** ***** ***** ****** *********** ********(**** **% **** ** **********). ** is ******** **** ******** *** ******** since ****, ******** ** ** ******** to **** **** ** ************.

Big ******* *****: *** ****** ***********

****** ******* *** ******** ** ** ******* rights *************** ******* *****, ***** *** *************** *** ******** **-** ** **** the *** *********** ****. ******** ** **** ******, Carlo **** **** **** *** *** "should ******** **** * **** ******** investigation":

IPVM Image

** **** **** *** ******** ***** the ******** ** *** ******** **-**'* use ** ********* ****** *********** ************, and **** ************* ***** *** ******* is ****** **** *** **** ***** privacy **** ****** ******. ** *** view, *** ******** **-**'* ************ ********* are **** **** ** ***** ********* and *** ***** *** ***** ** impact,the *** ****** ******** **** * **** ******** *************.

*** *********** ** ****** ********* ** secret ********** **** ** *** *******, meaning ****** *** ** *********** *** denied *** *********** ** ** ***** food ******** ******* ***** ********. **** is ** ****** ********* *** ******* chilling *** *** * ******** ** behave.

*** ******** **-** ******drop *** ****** *********** ******* ***********. [emphasis added]

***** ***** **** ***** ********* ******* helps **** ******** **-**'* ****** "*** most ********, ********* *** ****-***** ****** supermarket ** *******":

IPVM Image

** ** ****** ******** **** *** Co-op's ********* **** *** **** ***** local *********** ** ****** ** ****, much **** **** ******* *****-***** ********** is ***** **** ** ** **, unless ******* *** ************** *** ***** reports.

*** ******** **-**’* *** ** ********* facial *********** ***Hikvision ******* ** ***** ** ******** ***** **** *** **** ********, ********* *** ****-***** ****** *********** ** *******. [emphasis added]

IPVM Image

ICO ********

**** ********* * ******* ** *** findings ** *** *** *** ***** whether ** ***** ***********. *** *** not ******* ** ******** **-**'* ****** but ****** ********* **** ********* ** "amongst *** *************" ** ** "********* the ********** **" **** ******* *** of *** **********:

IPVM Image

**** ********** *** **** * **** bar *** ****** ******, ****** *********** and ********** ** ******* *** *** of **** ****** *********** (***) ********** and *** ********** ** ****** ******. We **** ********* ** *** ******** Opinions *** ********* **** ********** ********* that ************* **** ****** ****** *** during *** *** ** ***.

** **** *** *** **********, ** is ******* **** ******'* ******* ** at *** ***** ** *** ********* to ****** *** ** ****** ***** and ********** *** *** ****.

** *** ********* *** ********** ** a ****** ** ******* ********* *** have ****, ** *** ********* *****, live ****** *********** **********. ********* ** amongst *** ************* ***** *************

Surveillance ****** ************ ********

****** *******, *** ** **********'*********** *** ************ ****** ************, **** **** "****** ***** ****** be *******, ******** *** *********" ** a *** **** "*****[*] ****** ** no ***** **** ***** ****** **** be ********":

IPVM Image

** *** ***** ** *******, **** is ****** ** ***** *** ** the ******* ** ** ***** ****** in ** ***** **** ***** ****** will ** ******** ** **** ***** premises *** ** ******** ****** ***** whether **** **** ** ****** **** condition ** *****, ****** ***** ****** be *******, ******** *** ********* ** a *** **** ******** **** ***?

********* ********* *****, ******* ***** **** Hikvision - ***** ********** ** ******** **** ******** *** ******** ********** - "*** said **** ****** *** ***** ******** tells ****** * ***":

**** ** * **** ****** ********. While ** ********* ***** ****** **** the *** ** ************ ****** ******* by *** ****** *** ***** ***********, I *** ***** ** ** ** interview **** ********* ********* ** ***** I ********* *** ********** ** ******* practice – ********** *** ********* – if ** *** ** ****** ****** trust *** ********** ** *** ********** use ** ****** *********** *********. * also ***** ***** *** ********** ** ethical ********** ** **** **** ***** I ******* ******** *** **** ********** to ********* *** ******** ******** **. As *** **** * **** ******** raised * ****** ** ********* ********* with ********* ******* ****** ***. ** far ***** ****** *** **** **** little *** ***** ******** ***** ****** a ***.

One ***** **** ** ******* ***** ** *** ******

*** *****, *** **** **-** ** Portsmouth, *** ** ******* ********** **********:

IPVM Image

**** ******** *** **** ***** **** violation **** ***** ****** *********** ****** ** ****** "******" ******* of *** ****** "***** *** **** covered" ** ***. *** ****'******** ****** **** ******** *** ** ** notified "** *** **** **** ******** data *** ********" *.*. ** **** as **** *** ******.

** *********, ******** **-** ******** **** the **** **** *** "*******" *** it *** *** **** "********", ***** IPVM *********:

IPVM Image

Tiny ******* ****'* **** ** ******

***** ****** **** ******** *** **** outdoor *******, *** ** *** **** and **** ** ******. ** *** Southern **-** *** ***** ** **********, the **** *** * ******-********** ****** of ** **-***** *****:

IPVM Image

**** ****** *** **** ****** ******** rather **** ***** *****, *.*. *** Southern **-** ** ******* **** ** Southampton:

IPVM Image

*** ******** **-** ******* **** ** Portsmouth:

IPVM Image

*** ******** **-** ****** **** ** Portsmouth ***** *** **** ***** ******** are *******, **** ** ****** *** the ********* *** ** ** **** distinct:

IPVM Image

*** ******** **-** **** ******* ** Southampton:

IPVM Image

*** ** *** ******** **-** ********** Square ** **********:

IPVM Image

Signage ***** ******** ** ******* *****

*** ******* **** ******* **** ******** on ******* ***** ***** ** **** they *** ***** ******** **** *** doors *** *******/*******, *.*. *** *******' Road ******** **-**:

IPVM Image

******* ******* ** *** ******** **-** on ******* **** ** **********:

IPVM Image

*** *** ********** ****** ******** **-** in **********, ***** *** *** ********** is ******** ** ********* *********** **** the **** *****:

IPVM Image

Only *** ***** **** ********* *******

**** *** ** *** **** ****** IPVM ********, *** ******** **-** ** Commercial **** ** ***********, *** * large **** **** *** ** ********** "prominent", "******* *******", *** "**********" *** was *** ** * ******* ***** door:

IPVM Image

Signs ****** ******

*** **** ******** **-** ****** *** larger ******** ***** ********** ****** ***********. However, ***** ***** ** *** ************* improve *** ******'* **** **********:

  • *** ***** **** ******** * **** to ******* **** ** ******** **-**'* ************ *** ** *********** ** ****** recognition.
  • *** **** **** *********** ** **-**'* website, ***** ** ******** *** ****** rather **** *** **** ** *** signs, ****** *********** ***** *** *********** *********** ** the *** *** *** ****'******** **, ******* ******* *******, *** ******** can ****** ***** ****, *** *** right ** ***** * *********.
  • *** ******** ***** *** ********* **** be ***************** ***** *** **** **** ******** by *** ***. *******, ****** *** ************** ******* ****** ** ****** "******" members ** *** ****** "***** *** area *******" ** ***.

Hikvision ****** *** ********

***** ** *** **** ****** ******** by **** **** ********* ******* ******* and ********. *** ***** (*** ***** in **********) *** ********* ******* *** not ********, ***** * **** ******* of ****** ****** **********, ****** *** others. *** ***** *********** ****** *** large ****** **** ********* ******* ******* to **** *** **** ****************** ****:

IPVM Image

******** **-** **** **** ***** ** "one ****** *********** ****** *** ****", however ** ****'* ******** ***** ** any ** *** ****** ***** ******** camera *** ***** **** *** ***. The ******' ********* ******** * ******* of ********* ****** *** **** *******, for *******, ** **-** ********** ****:

IPVM Image

** **-** **** *******:

IPVM Image

** **-** ******* ****:

IPVM Image

** **-** ********** ******:

IPVM Image

** **-** ******* ****:

IPVM Image

** **-** ******* ****:

IPVM Image

** **-** *** ****:

IPVM Image

** **-** ****** ****:

IPVM Image

Facewatch *** ********* **********

** ******** ****, ********* *** *** - * ***** ** ********* *********** - ************* *** "****** ******"** ********** * "* **** ********, GDPR ********* ****** *********** ********":

IPVM Image

** **** *** *********, ** ******** (** *******) *** GDPR *********.

Facewatch, *********, *** ** ********

**** *** *** ******* * ******** to *** ********* **** *********, *********, or ***. ** ** **, ** will ******.

Comments (9)
IA
Igor Averchenko
Jan 17, 2022

**** ***** *** "*******" ******* ** human ***** ****** ** ********** ******* across ******* ****** ** ***********?..

(1)
Avatar
Charles Rollet
Jan 18, 2022

****** *** **** *******, **'* * good *****.

** ** *****, ******* *** *** human-based ****** ** '*******'. *** ********** personal **** ** ********* ** *** GDPR, ** **** *** *** ******* photos ** *********** *** ******* ** the **** *** ******** **** ********** regulations. *** ******* ** *******, ******* ********* *** ************* ******* **** ******* ** *********** suspects.

**** ******** **-**/********* *** ***** **** pose * ******* **** ********** ******. For *******, ********** **** ** ** a "***** *****" *** **** "*** technologies" **** ** * **** ********** Impact ********** (******* **). ****,******* ********** **** "********* **** *** *** ******* ** uniquely *********** * ******* ******" ** a '******* ********'. *********'* *** ****** has ******** **** ********* **** ********, creating * ****** ********** ******.

******* ** * ****** ** * shoplifting ******* ** * ***** *** pose ********* **** **********. *** **** doesn't ******* ********** *** ******** ********* data ** ***** ****** ******* ******** the ***** **** *********'* *** ****** does. **** ** *** **** ******* are ***** **** ******* ********** ********.** *****'* **** ********* ******, "***** *** ** **** *** *** automatic, ************** ********** ** ********* **** in ****** ******, ***** ** * high *** *** *** *** ** be ******".

(2)
JH
John Honovich
Jan 18, 2022
IPVM

********** **** ** ** * "***** scale" *** **** "*** ************" **** do * **** ********** ****** **********

*** **** **-** **** ****? ** such ** ********** ******?

Avatar
Charles Rollet
Jan 18, 2022

**** ********, *'** **** ***** **** that *** **** ******. ***** ****** that ******* ***** **** ********,********* ********* *** "*** ******** ********* ** most *****" **** ** ** *** processing ** "*** *** ******** ** crime ********** *** *********":

** * **** ********** *** **** perform * **** *** ********** **** is ****** ** ****** ** * high **** ** ***********. ***** ** unlikely ** ** * **** **** if **** ******** ******** **** **********for *** ******** ** ***** ********** *** ********* in line with your business’ procedures, the 6 Data Protection Principles and the Facewatch Subscriber Agreement

*******, ** ** **** ******** ** prepare * **** *** *** ********** of ******** **** ***** ***** ** a **** ** *********** **** **** things ** ***** *****, ******, ************ access ** * **************** ********.

* ****, ******not ******** ********* ** **** *****, will help you identify the measures your business takes in order to reduce the likelihood or impact of those risks, and thereby fulfil both the Accountability Principle and the requirement for Data Protection by Design and Default contained within the UK Data Protection Act 2018 and GDPR. [emphasis added]

** ** **** ***** ** ** language ** *** **** **** "***** prevention *** *********" **** *** ********** a "**** ****". **** ** *********'* (quite **********) ****.

Avatar
Charles Rollet
Jan 18, 2022

****, **, ***** ** ** ******* for ***** ** ** ******. **** companies *** ******* ****** ** ******** the ****** *** **** ** *********.

Avatar
Charles Rollet
Jan 18, 2022

****** - ******** **-** **** **** did * ****, *** **** ******* to ******* **:

******** **-** ******* *** * **** protection ****** ********** ***** ** ******** to ** ************ ******** ***********. ** were ********* **** *** ******* *** believe **** *** *** ** *** system ***** *** ***** ** ***** necessary *** *************.

(1)
Avatar
Max Protein
Jan 18, 2022

*** ***** *** ******** ******** ** harm, ****** ** ****** ****** ** Co-op’s *** ** ***** *** *******? If ***, *** ** **** *********?

** *** ******* ********** *** *** brother ********, ******* ******* ********** ****** not ** **** ** *** **** standards.

Avatar
Max Protein
Jan 18, 2022

**** **** ** ******* ******* *** UK ********** ** ***** ** ** anti-encryption ********* ***** ** ******* *** public **** *** ** *** ********** is ******* *** ********. *** * joke.

*********** *** ********** **** ** ***********. Leave *** ******* ********** ***** *** focus ** **** *** ************.

(1)
Avatar
Charles Rollet
Apr 01, 2022

******: ******** ********* *** *** ******* to ****'* ******** *** ******* *** this *******, *** *** **** ****** accused **** ********** ***** "* ********** *** *** Brother *****":

IPVM Image

** ******, **** ** *** * Big ******* ***** "**********". ** ****** them *** ** ***** ******** ** this ***** - ** ** ****** cited ** *** ** ***** ** privacy ****** ** ***** ** ********** ****.