Council of Europe calls for strict regulation of facial recognition

The Consultative Committee of the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data has issued a set of guidelines on facial recognition technology (FRT), addressed to governments, legislators and the private sector. The committee recommends that a democratic debate is held on the possibility of a moratorium on the use of FRT in uncontrolled environments (such as public and semi-public spaces), pending a complete analysis of the impact that the technology has on human rights. It also recommends that the use of FRT for the sole purpose of determining a person’s skin colour, religious or other beliefs, sex, racial or ethnic origin, age, health condition, or social condition should be prohibited unless appropriate safeguards are provided for by law to avoid any risk of discrimination. Legislators and decision makers are invited to establish specific rules for biometric processing by FRT for law enforcement purposes to ensure that such uses are necessary, proportionate, and accompanied by adequate safeguards. At the same time, the covert use of FRT by law enforcement should only be possible if it is strictly necessary and proportionate to prevent an imminent and substantial risk to public security, which should be documented before the covert use. Recommendations for companies that develop and sell FRT include: (a) ensuring that facial recognition data are accurate (e.g. avoid mislabelling); (b) ensuring that algorithms are developed based on diverse datasets; (c) taking reasonable steps to help entities using FRT to apply transparency and respect for privacy; and (d) adopting specific measures to comply with data protection principles. According to the committee, entities that use FRT should be able to demonstrate that this use is strictly necessary and proportionate and that it does not interfere with the rights of the data subjects.