AP: facial recognition in supermarket 'major invasion of privacy'

Facial recognition is in principle prohibited, but there are some exceptions. In a new legal framework, the Dutch privacy regulator Autoriteit Persoonsgegevens provides clarity about the rules surrounding facial recognition.

Facial recognition may be used if users have freely given explicit consent. Another exception is if facial recognition is necessary for authentication or security purposes, for example in the protection of hazardous substances. However, it may not be used to determine someone's identity, according to the AP. The technology may not be used to secure a supermarket, for example, the AP emphasizes. In the legal context, the regulator gives an example of a supermarket wanting to use facial recognition to prevent theft and to protect property and employees. The supermarket would like to ask all customers for explicit permission, but in practice that is virtually impossible, according to the AP. “This exception is therefore probably not useful for a supermarket.”

Protecting property is also not a sufficient exception, the supervisor believes. Although this is a compelling interest, there does not appear to be any compelling general interest. “The use of facial recognition is also a major violation of the privacy of all visitors and this outweighs the compelling private interests of the supermarket.”

The AP has been warning supermarkets against the use of facial recognition for some time. However, in 2020, the AP said that the technology should not be used without customers' permission. That suggested that this was allowed with permission. The regulator is now backtracking on this.