In a new legal general framework facial recognition, the Personal Data Authority (AP) answers a number of frequently asked legal questions about the deployment of facial recognition. The document is intended for privacy professionals and organizations looking to deploy facial recognition.
Facial recognition is prohibited in most cases, but there are exceptions. The paper answers questions that are unclear among professionals dealing with this technology.
Facial recognition is in principle prohibited. One of the exceptions is that the use of facial recognition is necessary for authentication or security purposes (Article 29 of the General Data Protection Regulation Implementation Act). The explanatory notes to the UAVG give one example where the exception might apply: the security of a nuclear power plant.
The facial recognition legal framework now provides a new example: the security of hazardous materials that could be used to manufacture bombs, for example. The AP approved in 2023 the code of conduct of port companies handling international shipping traffic. This stipulates, among other things, that the security of such hazardous materials can be done with facial recognition under strict circumstances. But only if a data protection impact assessment (DPIA) has been carried out beforehand, showing, with justification, that it is necessary and that there is a compelling public interest.
The AP also clears up the ambiguity as to whether the processing ban for special personal data now applies in the case of facial recognition for the purpose of confirming a person's identity. The AP concludes that the processing ban does indeed apply in that case.
The AP also defines the conditions under which there can be "personal or household use" in the application of facial recognition. If this is the case, then the General Data Protection Regulation (AVG) does not apply. The AP cites the example of unlocking a phone with facial recognition. This is allowed, but only if the biometric data is stored on the phone itself, and the user decides what happens to that data. The user must have the choice to use facial recognition or to unlock the phone with a PIN, for example.
As consumers increasingly encounter forms of facial recognition, the AP has also published information for them using the new legal framework. If consumers know how facial recognition works and when its use is or is not permitted, they can better defend their privacy rights.
