AP warns: facial recognition cameras in supermarket banned

We regularly read stories about far-reaching technology and in what ways that technology captures data from individuals. In China, for example, cameras with facial recognition are widely used. Anyone who commits an offense is recognized with this technology and then receives a fine on the mat.

Although it usually doesn't go that far yet in the Netherlands, camera surveillance is being used in many places here as well. Sometimes this uses the possibility of facial recognition. This is not used to impose fines, but rather to recognize shoplifters, for example, in order to keep them out of the store. These cameras can do much more. For example, they can monitor buying behavior and profile customers and link them to social media.

In Europe, we find this less desirable than outside. For this reason, the use of facial recognition in supermarkets is banned in principle. Last December, the Personal Data Authority (AP) alerted a supermarket to this ban and warned against the use of camera surveillance with facial recognition. What exactly is the situation?

Camera surveillance with facial recognition

When cameras with facial recognition are used, the facial characteristics of all persons entering the picture are recorded and processed. These biometric data are classified as special personal data, the processing of which is prohibited under the General Data Protection Regulation (GDPR). Biometric data may only be processed if one of two exceptions occur.

First, processing is still permissible if the data subject has given explicit consent. This requires, among other things, that the consent has been freely given, is based on sufficient information and has been given with an unambiguous, active action. The latter means that tacit consent, such as walking into a store where facial recognition cameras are hanging, does not count as express consent. Thus, those who remain silent do not consent in this case.

The second exception means that the processing of biometric data is allowed despite the prohibition if it is necessary for authentication or security. This must involve a compelling interest. The most telling example is when biometric data are required for the security of a nuclear power plant or a database containing highly confidential information. While business owners has a strong interest in preventing theft, this is not of the same weight as securing a nuclear power plant or a database. Therefore, the AP finds that facial recognition is not necessary for supermarket security.

Camera surveillance possible though

The AP has warned that using facial recognition cameras in this situation is not allowed under the AVG. However, this does not mean that the use of cameras is not possible at all. When certain conditions are met, regular cameras may be used to deter theft and protect employees and customers.

First, this requires that a legitimate interest exists for the use of the cameras. Countering theft or wanting to protect customers and employees are such legitimate interests.

In addition, hanging the cameras must be necessary to protect those interests. This means that there is no other, less intrusive option to protect the interest and that the camera surveillance is not a stand-alone measure, but part of a total package of measures. For example, in addition to employing a security guard or using security stickers on products. You can also take care to hang as few cameras as possible.

Furthermore, as business owner , you must always weigh interests before hanging cameras. This involves weighing the interests of customers and employees against the interests you have as business owner in camera surveillance.

Finally, in some cases, a data protection impact assessment (DPIA) is required. A DPIA clarifies what the privacy risks of camera surveillance are and what measures (can be) taken to mitigate those risks. A DPIA is required when camera surveillance is deployed on a large scale and/or systematically or when there is hidden camera surveillance. If there is no hidden camera surveillance, customers and employees must be informed of the cameras before walking into the business. This can be done through a sign showing that there are cameras and their purpose. An internal policy can be drafted for employees. Note that the Works Council does have to agree to that policy.

If you are wondering what your options are for hanging cameras (with facial recognition) or need help with conducting a DPIA, feel free to contact us.