Stephen Bonner, the ICO’s Deputy Commissioner for Regulatory Supervision, has published a blog outlining the investigation the ICO undertook in relation to Facewatch’s use of LFRT and advice for private sector organisations consider LFRT use.

Mr Bonner explains that the security company Facewatch provides LFRT to the retail sector. Its product aims to help businesses protect their customers, staff and stock. The system scans people’s faces in real time as they enter a store and alerts if a “subject of interest” has entered.

In the interests of balancing the legitimate interest of the detection and prevention of crime with the privacy rights of the individual, the ICO undertook an investigation into Facewatch’s use of LFRT. The regulator considered whether Facewatch’s product complied with data protection legislation. Mr Bonner explains that whilst the ICO agreed that the company had a legitimate interest in using people’s personal data, it identified various areas of concern.

The ICO highlighted these areas of concern and gave Facewatch time to address them. In response, Mr Bonner says, Facewatch made, and continues to make, improvements to its product, including reducing the personal data it collects by focusing on repeat offenders or individuals committing significant offences, improving its procedures by appointing a Data Protection Officer and protecting those classified as vulnerable by ensuring they do not become a “subject of interest”.

Based on the information provided by Facewatch about improvements already made and the ongoing improvements it is making, Mr Bonner says that the ICO is “satisfied the company has a legitimate purpose for using people’s information for the detection and prevention of crime”. Accordingly, the ICO has concluded that no further regulatory action is required.

Mr Bonner stresses that the closure of the Facewatch investigation does not bring the ICO’s involvement in this area to an end. He says that each new application must be considered on its own merits, balancing the privacy rights of people with the benefits of preventing crime, and the ICO will continue to monitor the evolution of live facial recognition technology to ensure its use remains lawful, transparent and proportionate.

Finally, Mr Bonner says that the recommendations made by the ICO in its “Opinion on law enforcement use of LFR”, published in 2019, and its “Opinion on the use of LFR in public places”, published in 2021, remain relevant and the ICO expects all organisations to consider them carefully before deploying LFRT. Should non-compliance come to light the ICO may take enforcement action if appropriate. To read the blog post in full, click here.