You can run, but you can’t hide - Facial Recognition, AI and the Law

I. Introduction
Data is called the 'new oil' as it has become an exploitable resource. Like the Californian Gold Rush in the 19th century where people thronged to mine gold, today, both governments and private entities are rushing to mine data.

In the present milieu, cameras are ubiquitous. From smartphones and laptops to aircraft and satellites, cameras are everywhere. Over time, the cameras became capable of capturing high-resolution images. This capability made facial recognition technology a reality. Facial recognition technology is possible because of 'Artificial Intelligence' (A.I.) and 'machine learning'. Today, both A.I. and machine learning is developing at a breakneck pace. Both A.I. and machine learning has helped convert 'raw facial data captured using cameras'[1] to meaningful resources for various purposes. This face data can be used for a host of things ranging from security and surveillance to even snooping.

Facial recognition is a form of biometric data. A dictionary definition of biometric data is - 'detailed information about someone's body, such as the patterns of colour in their eyes, that can be used to prove who that person is'.[1]

Law always attempts to keep pace with any social or technological developments. But, the law has largely been a laggard in many jurisdictions when it comes to facial recognition technology. With this backdrop, the article will proceed as follows. Part II will briefly deal with the various ways in which facial recognition can be used and misused. Part III is a discourse on how facial recognition is dealt with by the laws of some major jurisdictions of the world. Part IV is the conclusion.

II. Boon or bane?
Every major technological development or invention, be it the invention of the telephone, the fax machine, or the computer brings with it the ability to impact human lives. Although such inventionsare meant to make positive impacts on human lives, it brings with it some inherent downsides. Facial recognition is no exclusion to this assertion.

II. 1. The good.
(i) Safety and security- Most humans tend to avoid indulging in malicious activities when every movement of theirs is tracked. This type of close monitoring is possible by continuous tracking of an individual through facial recognition in the public. The enforcement agencies can monitor the tracks of a repeat offender using facial recognition and prevent harmful conduct. For instance, in 2019, New York Cops were successful in arresting a rapist who was trying to force himself on a woman at gunpoint.[2]

Further, if the Police were to carefully monitor a person's activities, their response time in arriving at a potential crime scene will increase manifold.

(ii) Convenience - Facial recognition can be used as a bio-verification tool to verify your identity. One common example is the 'face unlock' feature in smartphones. In 2017, a restaurant started using this technology to remember customers' previous orders.[iii] Soon, facial recognition might become commonplace for completing purchases.

(iii) Monitoring safety violations- Authorities can monitor persons who are under mandatory quarantine during epidemics and pandemics. Facial recognition can detect and automatically alert the authorities if someone violates the quarantine. This reduces the need for the authorities to be physically present in a scene.

II.2. The bad.
(i) Bias and inherent errors - An A.I. model with inadequate samples may result in wrongful identification. For example, an A.I. model with inadequate face data frompeople from different racial and ethnical backgrounds may result in incorrect facial recognition of people of those races or ethnical backgrounds. In a shocking incident involving facial recognition, Sri Lankan authorities mistakenly imputed a Muslim US college student to be involved in bombings in Sri Lanka.[iv]

(ii) Free speech concerns - Close surveillance can alter the behaviour of people. People will become increasingly self-aware of what they talk. 'The mere possibility of surveillance has the potential to make people feel extremely uncomfortable, cause people to alter their behaviour, and lead to self-censorship and inhibition.'[v]

(iii) Privacy concerns - A person's movement from where he lives to where he goes and the people he meets can be easily monitored and tracked. This might raise privacy concerns. Police in the UK used a particular area as testing grounds for live facial recognition. The Police would sit in a van and match pedestrian face data with criminal profiles and arrest them on a positive match. A man who covered his face to avoid his face being tracked was fined £90 for non-compliance.[vi]Such incidents could become common if facial recognition becomes widespread.

III. Implementation of facial recognition and the Law.
III. 1. China
The authoritarian nature of the Chinese government undoubtedly leads them to control the information that comes in and goes out of the country. Such authoritarian character can be extrapolated to the control China seeks over its people throughthe information of their movements. Facial recognition is a handy tool in this regard. In Guiyang, the capital of Guizhou province, if you are a citizen they can 'match your face with your car, match you with your relatives and people you're in touch with … know who you frequently meet.'[vii]

China collects face data by with its mammoth network of nationwide camera systems. 'Skynet Project', which is China's national-level surveillance project, was started with around 20 million live facial recognition cameras.[viii] Today, it is estimated that China has around 200 million surveillance cameras across the nation.[ix] This number is expected to explode to a whopping 626 million by the end of 2020.[x]

China is proposing a social credit system wherein every move you make will determine your social credit score, including what you shop. The people with the best scores would get the best treatment in public space such as airports, get government jobs, and they would get admissions into the best Universities.[xi] Consequently, those with a poor score will be deemed outcasts.

The law regulating facial recognition is not robust in China. Cybersecurity Law of the People's Republic of China[xii] regulates facial recognition technology. However, a perusal of this law reveals that issues concerning biometric data are not adequately addressed.

Subsequently, China enacted China's Personal Information Security Specification[xiii]into force. This law speaks about the collection, retention, use, processing, sharing, transfer, and public disclosure of personal information. Interestingly, this Specification is more of a guideline for agencies rather than a law which imposes rights and obligations.

At the moment, China is deliberating on a new law which encompasses the specific issues brought forth by data privacy.[xiv]

III. 2. Russia
Recently, a Russian court has held that facial recognition does not violate a citizen's right to privacy.[xv] Russia has been using CCTVs with facial recognition technology heavily in times of COVID. In particular, Moscow has been using facial recognition to monitor quarantine restrictions with nearly 105,000 cameras.[xvi]An A.I. analyses the face data and builds a unique profile for each face.

It is noteworthy that one of the main developers of the government's A.I. system, NTechLab, previously developed an app called 'FindFace'. When a user captures a picture of someone's face, FindFacelooks into its database and produces images and details of the person who face was pictured. On paper, this might seem novel, but it raises serious privacy concerns. NTechLab has taken the app down ever since it started working closely with the government.

Another Russian Court stated that 'citizens' video images obtained via face recognition technology in the municipal video surveillance system cannot be considered biometric data'.[xvii] In light of such a holding, whether or not the various data protection laws of Russia[xviii] would apply to face data becomes a moot point.

III. 3. Unites States
The United States is one of the forefronts of technological development. The demand for facial recognition technology is on the rise in the US, primarily for surveillance. In the US, sporting events have started to use facial recognition technology to identify staff, press, and even potential threats by 'searching against state/local and national law enforcement databases'.[xix] In the wake of the Black Lives Matter movement, IBM announced that 'IBM will no longer offer general-purpose facial recognition or analysis software'.[xx] IBM believes there is an inherent bias in facial recognition technology and there is a potential for its misuse of the technology by the law enforcement agencies.[xxi] Very recently, the American Civil liberties Union filed a formal complaint against the Detroit Police Department over a wrongful arrest caused by facial recognition technology.[xxii]

But facial recognition is perceived as a threat to the constitutional rights contained in the First and Fourth Amendments. Several Police Departments including the Police Departments of Orlando, Washington, D.C., New York City, Los Angeles, West Virginia Intelligence Fusion Center, Seattle South Sound 911, and Dallas Area Rapid Transit—had purchased or had announced plans to purchase face surveillance systems.[xxiii]

Three US States, California, Oregon, and New Hampshire, have banned the facial recognition technology for the 'body cams' of the Police. Further, the cities 'San Francisco and Oakland in California, Brookline, Cambridge, Northampton and Somerville in Massachusetts have all banned the use of facial recognition technology by city agencies.'[xxiv]

Collection and use of biometric data by private entities have been regulated by several States. Illinois enacted the Biometric Information Privacy Act (BIPA) in 2008 which restricts how private parties can collect and use biometric data. Texas enacted the Biometric Privacy Act which requires the consent of the individual before the collection of their biometric data. Texas law also limits the sale or disclosure of an individual's biometric identifiers except under limited circumstances.[xxv]

Washington enacted biometric privacy protections in 2017 that 'prohibits any company or individual from entering biometric data into a database without providing notice, gaining consent and providing a mechanism for preventing the subsequent use of the biometric data for a commercial purpose.'[xxvi] New York's New York's Stop Hacks and Improve Electronic Data Security (SHIELD) Act makes notifications necessary if there is unauthorized access to the biometric data of the citizens of New York.

California has enacted the California Consumer Privacy Act of 2018 (CCPA). Under CCPA, Californians can 'request that a business disclose the categories and specific pieces of personal information it collects, the categories of sources from which that information is collected, and the business purposes for collecting or selling the information.'[xxvii] Further, 'It also grants Californians the right to request that a business delete and cease selling to third parties their personal information.'[xxviii]

III. 4. European Union
The European Union's data privacy laws are regulated by the General Data Protection Regulation (GDPR)[xxix]. Article 4 of GDPR defines biometric data and it includes face data. Article 9 of the GDPR deals with the processing of 'special categories of personal data'. Under Article 9, A person's explicit consent is required for processing their biometric data.

Although the GDPR provides for restrictions on how biometric data is collected and processed, the EU is well aware of the potential privacy concerns that the facial recognition technology presents. Hence, the EU officials 'plan to regulate certain applications of facial-recognition technology' in 2020.[xxx] The officials also clarified that this regulation will happen only in areas which may impinge on privacy and other rights.

III. 5. India
The facial recognition technology is very nascent in India. As India has not deployed a large number of CCTVs to capture face data, it has not been able to successfully exploit facial recognition technology. Recently, an article was published which claimed that India used facial recognition to identify more than 100 individuals in a riot.[xxxi] However, the same article stated that when the technology was used in 2019 identify missing children, it had an 'accuracy rate of 1%' and it 'even failed to distinguish between boys and girls'.[xxxii]

However, it will not be surprising if India followed the footsteps of China and install a massive number of facial recognition CCTVs across the nation. Legal ramifications will ensue if such a massive collection of face data occurs.

The law governing privacy is more or less rooted in the 547-page judgment of Justice K.S. Puttaswamy (Retd.), and Anr. v. Union of India and Ors.[xxxiii]. The judgment talks about the use of biometric data by non-governmental bodies concerning only Aadhaar. But the judgment - which can be considered a treatise by itself - does not contain any holding concerningthe collection and use of face data vis-à-vis privacy. But, the judges were mindful of the fact that 'the dangers to privacy in an age of information can originate not only from the state but from non-state actors as well.'[xxxiv] Further, the court reminded the government the 'need to examine and put into place a robust regime for data protection'.

Information Technology Act[xxxv] accompanied by the Privacy Rules form the primary law which regulates biometric data collection and use. The Privacy Rules[xxxvi] classifies biometric data as 'Sensitive Data'. 'Sensitive Data' is accorded some protection under the Privacy Rules.

The law related to data is sought to be consolidated in The Personal Data Protection Bill, 2019,[xxxvii]which is being drafted. It classifies biometric data as 'Sensitive Personal Data'. We will have to wait and see how this bill if it becomes a law, will deal with biometric data.

IV. Conclusion.
We live in a world where privacy and the urge to maintain anonymity has become paramount. Facial recognition is a disruptive technology and it still has not attained its full potential. Along with the numerous benefits that facial recognition brings to us, it has the potential to trounce on personal rights.

To the governments, information is power, the more they know about you, the more control can be exercised over you. To the private entities, the more information they have, the more ways they will exploit it to generate revenue. But there ought to be limitations on how much information the government or private entities are allowed to collect and store. Thus, this disruptive technology has given wake up calls to legislators to legislate and improvise the laws in data protection and privacy. Major concerns pertain to the right to privacy, free speech, and the bias it may cause.

What we need today is a robust regime of data protection laws. The EU has attempted to create such legislation and countries like the US and Russia are following suit. Countries like India must act swiftly act to keep pace as there is a big gap in the development of technology and the development of law. With timely and proper regulation, facial recognition will positively impact human lives.

[1] Hereinafter referred to as 'face data' for the sake of convenience.

Endnotes:
[1] Dictionary.cambridge.org. 2020. BIOMETRIC | Definition In The Cambridge English Dictionary. [online] Available at: [Accessed 29 June 2020].

[2] New York Post. 2020. Facial Recognition Leads Cops To Alleged Rapist In Under 24 Hours. [online] Available at: [Accessed 29 June 2020].

[iii] Rouse, I., 2020. There's A Burger Chain That Uses Facial Recognition To Remember Your Orders. [online] HYPEBEAST. Available at: [Accessed 29 June 2020].

[iv] TheHill. 2020. Sri Lankan Authorities Mistakenly Include Muslim US College Student's Face Among Bombing Suspects. [online] Available at: [Accessed 29 June 2020].

[v] The International Justice and Public Safety Network, Privacy Impact Assessment: Report for the Utilization of Facial Recognition Technologies to Identify Subjects in the Field (June 30, 2011), Document p. 016632.

[vi] Ft.com. 2020. How London Became A Test Case For Using Facial Recognition In Democracies. [online] Available at: [Accessed 29 June 2020].

[vii] Prod. Joyce Liu, In Your Face: China's all-seeing state, BBC News (Dec. 10, 2017), https://www.bbc.com/news/av/world-asia-china-42248056/in-your-face-china-s-all-seeing-state at 1:16.

[viii] South China Morning Post. 2020. 'Skynet', China'S Massive Video Surveillance Network. [online] Available at: [Accessed 29 June 2020].

[ix] Nytimes.com. 2020. Inside China'S Dystopian Dreams: A.I., Shame And Lots Of Cameras. [online] Available at: [Accessed 29 June 2020].

[x] South China Morning Post. 2020. China Working On Data Privacy Law But Stumbling Over Enforcement. [online] Available at: [Accessed 29 June 2020].

[xi] ABC News. 2020. She's A Model Citizen, But She Can't Hide In China's 'Social Credit' System. [online] Available at: [Accessed 29 June 2020].

[xii] New America. 2020. Translation: Cybersecurity Law Of The People'S Republic Of China (Effective June 1, 2017). [online] Available at: [Accessed 29 June 2020].

[xiii]New America. 2020. Translation: China'S Personal Information Security Specification. [online] Available at: [Accessed 29 June 2020].

[xiv] South China Morning Post. 2020. China Working On Data Privacy Law But Stumbling Over Enforcement. [online] Available at: [Accessed 29 June 2020].

[xv] U.S. 2020. Russian Court Rules In Favor Of Facial Recognition Over Privacy Claims. [online] Available at: [Accessed 29 June 2020].

[xvi]Reevell, P., How Russia Is Using Facial Recognition To Police Its Coronavirus Lockdown. [online] ABC News. Available at: [Accessed 29 June 2020].

[xvii] Decision of the Savelovsky District Court of 6 November 2019 Case No. 2a-577/19; See also DataGuidance. 2020. Russia - Data Protection Overview. [online] Available at: [Accessed 29 June 2020].

[xviii]Federal Law of 27 July 2006 No. 152-FZ on Personal Data (Russia); Federal Law of 27 July 2006 No. 149-FZ on Information, Information Technologies and Protection of Information (Russia); Federal Law of 26 July 2017 No. 187-FZ on Security of Critical Information Infrastructure of the Russian Federation (Russia); Federal Law of 24 April 2020 No. 123-FZ on the Experiment to Establish Special Regulation in Order to Create the Necessary Conditions for the Development and Implementation of Artificial Intelligence Technologies in the Region of the Russian Federation - Federal City of Moscow and Amending the Articles 6 and 10 of the Federal Law on Personal Data (Russia).

[xix] Sporttechie.com. 2020. Facial Recognition Technology Tested By LPGA, Is The NHL Up Next?. [online] Available at: [Accessed 29 June 2020].

[xx] The Verge. 2020. IBM Will No Longer Offer, Develop, Or Research Facial Recognition Technology. [online] Available at: [Accessed 29 June 2020].

[xxi] The Verge. 2020. IBM Will No Longer Offer, Develop, Or Research Facial Recognition Technology. [online] Available at: [Accessed 29 June 2020].

[xxii] Brian Fung and Rachel Metz, C., 2020. This May Be America's First Known Wrongful Arrest Involving Facial Recognition. [online] CNN. Available at: [Accessed 29 June 2020].

[xxiii] Clare Garvie, Alvaro Bedoya & Jonathan Frankle, The Perpetual Line-Up: Unregulated Face Recognition in America (Oct. 16, 2016), Available at: [Accessed 29 June 2020].

[xxiv] IPWatchdog.com | Patents & Patent Law. 2020. The Varying Laws Governing Facial Recognition Technology. [online] Available at: [Accessed 29 June 2020].

[xxv] Thompsonhine.com. 2020. State Biometric Privacy Legislation: What You Need To Know. [online] Available at: [Accessed 29 June 2020].

[xxvi] Thompsonhine.com. 2020. State Biometric Privacy Legislation: What You Need To Know. [online] Available at: [Accessed 29 June 2020].

[xxvii] Thompsonhine.com. 2020. California Expands Consumer Privacy Protections. [online] Available at: [Accessed 29 June 2020].

[xxviii] Thompsonhine.com. 2020. California Expands Consumer Privacy Protections. [online] Available at: [Accessed 29 June 2020].

[xxix]EU General Data Protection Regulation (GDPR): Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ 2016 L 119/1.

[xxx] Stupp, C., 2020. EU Plans Rules For Facial-Recognition Technology. [online] WSJ. Available at: [Accessed 29 June 2020].

[xxxi] Singh, M., 2020. India Used Facial Recognition Tech To Identify 1,100 Individuals At A Recent Riot. [online] Techcrunch.com. Available at: [Accessed 29 June 2020].

[xxxii] Singh, M., 2020. India Used Facial Recognition Tech To Identify 1,100 Individuals At A Recent Riot. [online] Techcrunch.com. Available at: [Accessed 29 June 2020].

[xxxiii]Justice K.S. Puttaswamy (Retd.), and Anr. v. Union of India and Ors., (2017) 10 SCC 1.

[xxxiv]Justice K.S. Puttaswamy (Retd.), and Anr. v. Union of India and Ors., (2017) 10 SCC 1.

[xxxv] The Information Technology Act, 2000, No. 14, Acts of Parliament, 2000.

[xxxvi] Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

[xxxvii] PRSIndia. 2020. The Personal Data Protection Bill, 2019. [online] Available at: [Accessed 29 June 2020].