Face off: facial recognition technology leaves regulators scrambling

From airline lounges to cricket matches, our faces are already being read everywhere. But what's protecting us from misuse of that data?

If you feel like facial recognition technology is suddenly everywhere you look — or rather, facial recognition is everywhere looking at you — you’re not alone. Not only do many of us carry the technology with us everywhere on our smartphones, it’s also increasingly present in the spaces we move through and the interactions we have in our daily lives, whether we know it or not.

Most people walking into the public library in Toowoomba last year, for example, were probably not aware that they were taking part in a controversial trial of facial recognition technology by the local council. Likewise the 45,000 visitors to the SCG for the final Ashes test this year were probably mostly unaware that their faces were being run through newly installed facial recognition cameras.

Certain people walking around the streets of the Northern Territory in 2015, on the other hand, suddenly found themselves very aware of facial recognition when police used the technology to identify 300 wanted individuals via CCTV footage.

Governments and businesses alike are embracing facial recognition. In addition to the controversial new national facial recognition database, the government has proposed requiring facial scans of recipients of Centrelink, Medicare and childcare subsidies. Westpac is using facial recognition and artificial intelligence (AI) to monitor its customers and employees through video surveillance, whilst Sydney Airport and Qantas are trialling a new biometric boarding system. Even cafes are getting in on the game, allowing customers to pay for their coffee using facial recognition linked to their payment card details.

The more widespread the technology becomes, the more important it is to build in safeguards, says Human Rights Commissioner Edward Santow, who is heading up the Commission’s new project on technology and human rights.

“New technologies like facial recognition bring huge opportunities which we should embrace, but at the same time as we’re putting our energies into finding new ways to take advantage of those opportunities, we also need to be putting just as much energy into ensuring necessary protections are in place,” Santow says.

Microsoft’s president Brad Smith has publicly called for government regulation of facial recognition technology, observing “we live in a nation of laws, and the government needs to play an important role in regulating facial recognition technology”.

Understanding how existing laws apply to facial recognition technology and what new safeguards might be needed is easier said than done, according to Rick Sarre, Adjunct Professor of Law and Criminal Justice at the University of South Australia.

“The digital frontier has left many aspects of the law reeling in its wake. Facial recognition technology is another example of where the law lags woefully behind,” Sarre says.

As a form of biometric data, facial recognition data is classed as “sensitive information” under the Privacy Act, which requires that such information cannot be collected without the person’s consent and that the way in which information will be managed must be laid out in a privacy policy.

This sounds simple in theory, but in practice it gets complicated. When Westfield was discovered to be using face detection technology to monitor its customers, a spokesperson for the retail giant pointed to the privacy policy on its website — but should simply walking through the door of a business be enough to count as having consented to their privacy policy?

“We are not even sure about the laws around CCTV, so the facial recognition issue is even more uncertain, legally-speaking,” says Sarre.

There are three steps which need to be taken as part of the path forward for facial recognition in Australia, according to Santow:

“Firstly, there should be a comprehensive review of how this technology can and should operate in Australia. Secondly we need to set up our laws and policies for facial recognition so that they align with the role we want facial recognition to play in our society. Thirdly, I think there needs to be some general guidance available in plain English about the legal rights and responsibilities related to using facial recognition, particularly for businesses.”

The Greens and Labor have expressed support for government regulation of facial recognition in Australia.

“Given the rapid rise of the surveillance economy, and the profitability of data, it should be extremely concerning for all Australians that technology is being developed, and actively applied in both the private and public spheres, to scan and store information about your facial features. Once that data is lost or compromised it is ripe for identity theft; you can’t get a new face,” says Greens Digital Rights spokesperson Senator Jordon Steele-John.

Professor Sarre is not optimistic about the chances for regulation in the near future.

“Because governments move slowly on matters such as these it will take a massive case of obvious affront before the regulations are likely to be updated,” he says.

What should regulators do about facial recognition technology, if anything? Tell us by writing to boss@crikey.com.au.