There have been media reports about the use of facial recognition in identity card applications. These state that municipalities are required to report its use to the AP in advance. However, this does not appear to be the case.
The news reports were the subject of discussion during a VNG consultation with the Personal Data Authority (AP). Contrary to what media reports suggest, municipalities are not required to contact the AP before deploying facial recognition. This is only required if prior research into the privacy risks of the processed data shows that high risks remain for data subjects, even after taking protective measures.
This study, called a Data Protection Impact Assessment (DPIA), helps to recognize the risks and, where necessary, take appropriate measures to reduce them. VNG therefore emphasizes the importance of performing a DPIA to ensure that data processing at municipalities is responsible and in line with laws and regulations. Municipalities that have concerns or questions about this can always contact the Information Security Service (IBD) of the VNG.
