Facial Recognition Is on the Rise – but the Law Is Lagging a Long Way Behind

Private companies and public authorities are quietly using facial recognition systems around Australia.

Despite the growing use of this controversial technology, there is little in the way of specific regulations and guidelines to govern its use.

Spying on shoppers

We were reminded of this fact recently when consumer advocates at CHOICE revealed that major retailers in Australia are using the technology to identify people claimed to be thieves and troublemakers.

There is no dispute about the goal of reducing harm and theft. But there is also little transparency about how this technology is being used.

CHOICE found that most people have no idea their faces are being scanned and matched to stored images in a database. Nor do they know how these databases are created, how accurate they are, and how secure the data they collect is.

As CHOICE discovered, the notification to customers is inadequate. It comes in the form of small, hard-to-notice signs in some cases. In others, the use of the technology is announced in online notices rarely read by customers.

The companies clearly don't want to draw attention to their use of the technology or to account for how it is being deployed.

Police are eager Something similar is happening with the use of the technology by Australian police. Police in New South Wales, for example, have embarked on a “low-volume” trial of a nationwide face-recognition database. This trial took place despite the fact that the enabling legislation for the national database has not yet been passed.

In South Australia, controversy over Adelaide's plans to upgrade its CCTV system with face-recognition capability led the city council to vote not to purchase the necessary software. The council has also asked South Australia Police not to use face-recognition technology until legislation is in place to govern its use.

However, SA Police have indicated an interest in using the technology.

In a public statement, the police described the technology as a potentially useful tool for criminal investigations. The statement also noted: There is no legislative restriction on the use of facial recognition technology in South Australia for investigations.

A controversial tool

Adelaide City Council's call for regulation is a necessary response to the expanding use of automated facial recognition.

This is a powerful technology that promises to fundamentally change our experience of privacy and anonymity. There is already a large gap between the amount of personal information collected about us every day and our own knowledge of how this information is being used, and facial recognition will only make the gap bigger.

Recent events suggest a reluctance on the part of retail outlets and public authorities alike to publicise their use of the technology.

Although it is seen as a potentially useful tool, it can be a controversial one. A world in which remote cameras can identify and track people as they move through public space seems alarmingly Orwellian.

The technology has also been criticised for being invasive and, in some cases, biased and inaccurate. In the US, for example, people have already been wrongly arrested based on matches made by face-recognition systems.

Public pushback

There has also been widespread public opposition to the use of the technology in some cities and states in the US, which have gone so far as to impose bans on its use.

Surveys show the Australian public have concerns about the invasiveness of the technology, but that there is also support for its potential use to increase public safety and security.

Facial-recognition technology isn't going away. It's likely to become less expensive and more accurate and powerful in the near future. Instead of implementing it piecemeal, under the radar, we need to directly confront both the potential harms and benefits of the technology, and to provide clear rules for its use.

What would regulations look like? Last year, then human rights commissioner Ed Santow called for a partial ban on the use of facial-recognition technology. He is now developing model legislation for how it might be regulated in Australia.

Any regulation of the technology will need to consider both the potential benefits of its use and the risks to privacy rights and civic life.

It will also need to consider enforceable standards for its proper use. These could include the right to correct inaccurate information, the need to provide human confirmation for automated forms of identification, and the setting of minimum standards of accuracy.

They could also entail improving public consultation and consent around the use of the technology, and a requirement for the performance of systems to be accountable to an independent authority and to those researching the technology.

As the reach of facial recognition expands, we need more public and parliamentary debate to develop appropriate regulations for governing its use.