Face value: Using facial recognition in retail

Facial recognition technology has been hitting the headlines as one of the most controversial disruptive technologies used for law enforcement. But what lessons should be learned by the retail sector from the present struggles between police and privacy campaigners?  

In the commercial sector, many will be familiar with Facebook and Google Photos’ use of the technology to sort and tag photographs and these tech giants alongside Apple and Amazon have been quick to explore and exploit facial recognition technology. But they are not the only ones. The American department store Saks Fifth Avenue has reportedly introduced the technology in order to cross reference shoppers with a database recording past shoplifters or known criminals. This has partly made possible by some shops in the US giving shoplifters the choice of being photographed rather than arrested.

Importantly, whilst the technology is primarily to detect thieves, it can also be used to track shoppers, identifying the most popular retail displays and traffic routes. This can help shops to compete with online retailers who track customers through cookies, although it is easier to disable cookies than to be aware of and avoid automated facial recognition. Facial recognition used for these purposes gives rise to obvious transparency and privacy concerns, including but not limited to the morality of surreptitious surveillance and the lawfulness, or otherwise, of storing and sharing personal data.

There are reportedly UK shops, in particular in the food industry, using the technology in a similar way to the reported Saks model, to disrupt theft. It is more difficult to ascertain the extent of facial recognition usage either directly or indirectly for non-law enforcement, that is, purely commercial, purposes. There is a real legal issue as to whether it is lawful for the commercial sector to use facial recognition technology at all, especially without informed consent.  

The UK retail and marketing sectors should be watching closely the way in which public sector law enforcement bodies are seeking to employ the technology, the guidance available to them and others, and the outcome of legal challenges to their actions.

This is because South Wales Police were recently challenged in the Administrative Court by a member of the public on their use of live facial recognition from a police van which captured his image while he was out shopping in Cardiff. The outcome of the case is expected later this year. If law enforcement is feeling the heat of privacy campaigners, the retail sector can only expect the same, if not greater, scrutiny and protest.

Those intent on using the technology should consider carefully the current guidance that is available to law enforcement bodies and to take advice regarding data protection legislation in the UK.

In March 2019 the Surveillance Commissioner published guidance entitled ‘The Police Use of Automated Facial Recognition Technology with Surveillance Camera Systems. While this guidance is self-evidently directed at police forces, it explicitly advises that operators of surveillance cameras, other than ‘relevant authorities’ within the meaning of the Protection of Freedoms Act 2012, are encouraged to adopt its principles voluntarily.

Early this month, the Information Commissioner, Elizabeth Denham, published a blog article entitled ‘Blog: Live facial recognition technology – data protection law applies’ confirming that the use of facial recognition software (particularly in the context of comparing personal data to a database of known individuals) constitutes processing personal data, and making reference to the South Wales Police case. As regards to non-law enforcement bodies, she commented that ‘Although data protection law differs for commercial companies using LFR [Live Facial Recognition], the technology is the same and the intrusion that can arise could still have a detrimental effect. In recent months we have widened our focus to consider the use of LFR in public spaces by private sector organisations, including where they are partnering with police forces. We’ll consider taking regulatory action where we find non-compliance with the law’.