No, not usually. Only in exceptional cases may you use cameras with facial recognition. This is because with facial recognition you are processing biometric data. These are special personal data if they are used for the unique identification of a person. And you may only process special personal data if there is an exception for this in the law.
Biometric personal data
If you use cameras with facial recognition, you will be processing facial images. These are biometric data. Just like fingerprints, for example. These body characteristics are unique. That's why organizations can use them to identify people. And also to verify that someone is who they say they are (authentication). Because these data are unique, they pose an extra high privacy risk. For example, if the data is stolen. It is not possible to modify a facial image or fingerprint, as can easily be done with a PIN or password.
Exceptions to ban
There are 2 exceptions to the ban on using facial recognition cameras.
Exception 1: necessary for authentication or security
You may use biometric data if it is necessary for authentication or security purposes. This must be in the public interest. That is, for example, the security of a nuclear power plant. But the security of a supermarket, for example, is not so important that you may process biometric data for that purpose.
Exception 2: explicit consent from data subjects
You may use cameras with facial recognition if the data subjects (the people you are filming) have given explicit consent. Note: explicit consent is a heavier form of 'normal', unambiguous consent. Explicit consent therefore requires more than unambiguous consent.
Privacy risks
Facial recognition carries major privacy risks. Keep that in mind if you want to use facial recognition cameras. You should include these risks, for example, in a data protection impact assessment (DPIA). The risks include:
bias (bias) and errors in facial recognition (the outcomes of facial recognition may be discriminatory and work less well with certain groups);
opaque information collection (facial recognition currently often works on the basis of models trained with images to which the individuals depicted have not given consent);
lack of a moment of choice or reflection for those involved (do I really want this?);
secondary use of data (for example, governments asking companies for the information they have collected with facial recognition).
