A discussion of how various facial detection and recognition systems operate, the privacy risks associated with different levels of identification, and the impact under GDPR. Facial recognition technology can help users organize and label photos, improve online services for visually impaired users, and help stores and stadiums better serve customers. At the same time, the technology often involves the collection and use of sensitive biometric data, requiring careful assessment of the data protection issues raised. Understanding the technology and building trust are necessary to maximize the benefits and minimize the risks.

Equally relevant is the need to expand stakeholders’ awareness and understanding of the many types of facial scanning systems, as well as the impact of accuracy differences among the many systems available today.

It is important to understand the distinctions between facial detection systems (which, when properly designed neither create nor implicate any Personally Identifiable Information) with full-scale facial identification programs (matching a person’s image to a database in order to identify the individual to a store clerk or stadium employee who otherwise wouldn’t recognize them).

The consumer-facing applications of facial recognition technology continue to evolve, and the technology will certainly be used in new ways in the future, and the legislative environment under GDPR must consider how such uses should be implemented to protect consumer privacy rights.