Will Industry Self-Regulation Emerge for Facial Recognition?

The FTC held its first ever workshop to explore the privacy and security implications of facial recognition technology on December 8.  Facial detection (identifying certain traits from a person’s face, such as age and gender) and facial recognition (identifying a specific person) technology is no longer futuristic technology found only in movies like the Minority Report.  Current uses include targeted advertising on billboards, tagging friends on social media sites, in mobile applications that report on the age and gender of a bar crowd, as well as assisting law enforcement in catching criminals.     

Panelists at the workshop included government officials, consumer privacy advocates, academics, and facial recognition industry representatives.  You can read transcripts of the four sessions here and the remarks of FTC Commissioner Julie Brill here.  The panelists emphatically discussed the absence of applicable regulations and how to appropriately address the emerging uses of facial recognition technology.  The questions involved whether a faceprint should be treated as “personally identifiable information,” should opt-in consent be required for the use of facial recognition but only opt-out consent for facial detection, and how to address uses that may also trigger concerns under COPPA or HIPAA.  In so doing, a clear consensus emerged that a higher order of scrutiny should apply to the use of facial recognition technology versus facial detection technology.

As with other emerging technologies, there was a debate as to whether the use of this technology should be addressed through new comprehensive privacy legislation or whether industry self-regulation would be sufficient.  On the self-regulatory side, the digital signage industry has issued the “Digital Signage Standards” and “Recommended Code of Conduct for Consumer Tracking Research.”  On the consumer privacy side, the Center for Democracy and Technology released a report in advance of the workshop that provided a summary of the technology, a description of existing commercial uses, and advocated for “a mix of government regulation, industry self-regulation, and privacy enhancing technologies.”    

The FTC indicated that facial recognition issues will be addressed in the final FTC staff report on its recommended privacy framework.  The final report, which is expected within weeks, follows the preliminary report issued by the FTC in December 2010.