No Dutch municipality that has conducted a facial scan when applying for identity documents has informed the Personal Data Authority. Nor has any advice been sought from the regulator, nor has any risk analysis been shared.
"Neglecting the duty to ask the AP for advice when processing personal data at risk is a serious offense," the authority told the Brabants Dagblad (BD). Municipalities, they say, use a face scanner because it makes identification easier and faster.
"The face scanner compares the person with the passport photos and the identity document. Changes in external features such as hairstyle or facial hair do not affect this. This allows us to be sure that the person at the counter, the passport photos and the identity document belong together," according to several municipalities.
The VNG informed that municipalities are not required to contact the AP in advance to use facial recognition. "This is only required if prior research into the privacy risks of the processed data shows that high risks remain for data subjects, even after taking protective measures. (...) The VNG therefore emphasizes the importance of carrying out a Data Protection Impact Assessment (DPIA) to ensure that data processing at municipalities is responsible and in line with laws and regulations."
Click here for the AP's notice.
