Why scrutiny of facial recognition needs to extend beyond policing

Facial recognition technology (FRT) is fast becoming part of everyday life in the UK.In recent months, much of the media attention around FRT has focused on the police, as forces up and down the country roll out both retrospective and live facial recognition (LFR). CEO of Face-Int UK and Europe. As deployment increases, so too does scrutiny. Concerns around the accuracy, privacy and efficacy, alongside debates over proportionality and whether widespread use is creating a “surveillance society”, all deserve serious consideration.But while so much of the conversation around FRT focuses on police use, we risk overlooking the growing use of facial recognition by private organizations.Public attitudes change depending on who is behind the cameraPublic attitudes towards facial recognition are rarely determined by the technology alone. Where it is used, why it is deployed, and, crucially, who is operating it can all influence public levels of support.There is an important distinction between FRT being used by the police to identify a wanted suspect – often for violent or sexual offences – and it being deployed by a retailer to identify someone suspected of previously shoplifting. Questions around accuracy, privacy, and the handling of biometric data are valid in both cases, but the purpose and context are very different.This disparity is reflected in public attitudes. Earlier this year, Face Int commissioned an independent survey of 2,000 UK adults which found that almost three quarters (73%) support police use of FRT, compared with 54% who support its use in retail environments.Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!This does not mean that police use should evade scrutiny, nor does it necessarily mean that people oppose private sector deployment. What it does show is that public acceptance of facial recognition cannot be separated from the circumstances in which it is used, or from the organization operating it.When police use LFR, its presence is typically made clear through marked vehicles and signage, often accompanied by advance announcements about when and where it will operate, and how data will be processed.In retail spaces, its use may not always be as obvious, nor will the public necessarily understand what happens to their data. This is particularly sensitive: 57% of respondents to Face Int’s survey said they were concerned about how images of their faces are stored.Moving beyond accuracyFacial recognition is often discussed in terms of its accuracy, with many reports of individuals being falsely identified. Ensuring that the technology is accurate, robust and appropriately tested is essential.But accuracy alone will not secure public trust. How facial data is collected, processed and stored, and governance surrounding its use, matter just as much. Indeed, 43% of the UK public stated that clear laws governing FRT would increase their trust in the technology.In the UK, FRT is currently regulated through a patchwork of legislation, including the Data Protection Act and the Human Rights Act. This means that those deploying the technology must interpret several laws to ensure they are compliant, leading to inconsistent standards across the sector. In contrast, the EU AI Act specifically addresses biometric identification, with additional requirements to protect the public and their data due to come into effect in December 2027.Earlier this year, the Government completed a consultation on a new framework for law enforcement use of FRT, but notably this did not extend to private sector deployments.More recently, the Independent Commissioner’s Office (ICO) published findings from its work examining police use of FRT, stating that it was working with forces and police oversight bodies to give the public confidence in its governance and oversight.What responsible use should look likeGreater scrutiny does not necessarily mean more restrictions. It should provide clearer expectations for how organizations capture, process and store biometric data.Organizations must be transparent about when and why FRT is being used. Information about the purpose of a deployment, what happens to people’s data and who is responsible for it, should be readily available before the data is captured.Privacy should also be built into FRT systems from the outset, rather than added after sensitive data has already been collected. Techniques such as hashing and other forms of biometric template protection can remove the need to capture facial images. This privacy-by-design approach should be a minimum expectation for those investing in FRT.Additionally, organizations should only capture and retain data they genuinely need. Data relating to individuals who do not match a legitimate watchlist should not be retained, while clear retention period should apply to information that does need to be stored.Robust security is also essential. Access should be restricted, with clear records of why, when and by whom data has been accessed. Anyone handling biometric data should receive appropriate training, and organizations must have processes in place for responding quickly and transparently to breaches.Finally, technology should support human decision making, not replace it. While the technology is improving rapidly, facial recognition matches must still be treated as an alert requiring human review.An opportunity for the new GovernmentThe recent change in government and dissolution of the Department for Science, Innovation and Technology (DSIT) makes this debate particularly timely.With DSIT’s responsibilities being spread across various departments and embedded across the Government’s wider economic and social agenda, there is an opportunity to develop a more coherent approach to facial recognition. After all, the implications of facial recognition extend far beyond the technology itself, spanning policing, the high street, data protection, security and economic growth.The Government must ensure its response to the proliferation of FRT is cohesive, with departments working alongside regulators and the private sector.The ICO’s examination of police use of FRT is a useful model for how scrutiny of the private sector could work. This could identify good practice and areas of concern, and inform clearer guidance or regulation.Responsible businesses should welcome that scrutiny. Clearer standards give businesses greater certainty about what good deployment looks like, and give the public greater confidence that their biometric data will be handled appropriately.The debate over facial recognition is not a binary choice between embracing the technology or restricting it. The question is how we can realize its benefits while ensuring its use is transparent, proportionate, accurate, and secure.Police deployments will rightly remain part of the conversation, but as facial recognition becomes commonplace across the private sector, scrutiny must follow. Public trust will depend not only on what the technology can do, but on whether people have confidence in how it is used and how their data is protected.We've featured the best authenticator app.This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit