The Impact on data protection /privacy in the GDPR era

Facial recognition is an innovative technology with a tremendous impact on a growing number of applications and sectors. Past and recent research on artificial intelligence revealed that machine learning and deep learning techniques have heavily influenced facial recognition technology development and utilisation.^[1] As a novel form of biometric technology, facial recognition operates by processing biometric information and data for identifying a human face, and subsequently, recognising the person.^[2] However, facial regulation is still virtually unregulated in Europe, and hence the need for further investigation into the emerging concerns over data security, privacy, transparency and accuracy. Studies conducted in North America and Europe demonstrated that facial recognition technology is gaining widespread application in law enforcement and commercial areas amidst major concerns over data protection and privacy , thus, the need for regulation.^[3]

Literature Review

Introduction

Whereas Artificial Intelligence (AI) is not explicitly stated in the EU General Data Protection Regulation (GDPR), a set of core provisions are fundamental to AI application, and a number experience concerns over the emerging mechanisms of processing personal data and information that Artificial Intelligence enables.^[4] Enforced on May 25, 2018, the GDPR primarily regulates organisations and businesses in the EU that utilises and processes personal data related to individuals residing in the EU.^[5] As the new privacy rules, the GDPR emerged when a growing number of competitive corporations in the EU and across the world are investing in the development and use of artificial intelligence tools and associated technologies.^[6]

Protecting Privacy in the Era of AI

According to Carly, facial recognition is a biometric technology that has been considered a threat to the right to privacy, for instance, law enforcement agencies have been reported to store databases containing photos for not only the criminals or suspected criminals but also persons who have never been the target of any investigation. ^[7]Another concern is using these systems by law enforcement personnel unlawfully to gather images of guilty and innocent persons without consent. Studies have also shown that corporations such Facebook, Instagram, Google, among other social media sites, have used their facial recognition solutions unlawfully. Studies have also shown that biometric technologies have to some extent, exacerbate existing inequalities and foster new harms.^[8]

The Ada Lovelace Institute report reveals that even though the public had varied opinions regarding biometric technology, the research opines that there is a general need for more regulation, particularly for law enforcement. ^[9]To this extent, there is a need to further debate about the proposed regulations.

The GDPR reduces the incentives for data sharing and limits the utilisation of data. For instance, in Article 5, companies are restricted from collecting new data before the comprehension of the potential value of the data; the Article also restricts the use of cold previously collected data beyond the scope of the initial purpose or for novel reasons.^[10] Beyond data restrictions, the GBPR restrictions also restrict automated decision-making in two ways, including allowing a data subject human review of the process of automated decision-making.^[11] The process must also include a redundant manual process as an alternative for those who choose not to utilise the automated process. To this extent, the corporations have a narrow margin for scaling AI because the rise in AI approaches raised the cost of manual processes. The second approach is the requirement of transparency about the logic involved in the automated process. Since it could be complex to explain some AI processes like neural networks, corporations could opt for human decision-making. ^[12] Unlike automated decision-making, profiling is considerably a new concept in European data protection law.

^[1]Chris Jay Hoofnagle, Bart van der Sloot, Frederik and Zuiderveen Borgesius. The European Union general data protection regulation: what it is and what it means (2019) 4.

^[2] Myranda Westbrook, Global privacy concerns of facial recognition big data (2020):11

^[3] Sharon Nakar and Dov Greenbaum, now you see me. Now you still do facial recognition technology and the growing lack of privacy (2017) 9.

^[4] Keyur Tripathi and Usama Mubarak, Protecting Privacy in the Era of Artificial Intelligence (2018) 3.

^[5] Lilian Mitrou, Data Protection, Artificial Intelligence And Cognitive Services Is The General Data Protection Regulation (Gdpr) “Artificial Intelligence-Proof”? (2018) 5.

^[6] Big Data Value Association, Data Protection In The Era Of Artificial Intelligence. Trends, existing solutions and recommendations for privacy-preserving technologies (2019) 7.

^[7] Carl Kind, The EU’s efforts to regulate biometrics: Exploring the gaps and risks relating to biometrics in the EU’s draft AI regulation (April 30 2011): https://www.adalovelaceinstitute.org/blog/canary-ai-coalmine-eu-regulate-biometrics/

^[8] Carl Kind, The EU’s efforts to regulate biometrics (2011)

^[9]Carl Kind, The EU’s efforts to regulate biometrics (2011)

^[10] Article 5 of the GDPR.

^[11] Article 22 of the GDPR.

^[12] Article 13-15 of the GDPR.