Facing Facts

Say facial recognition and it’s easy for people to get all Minority Report-ish.  But it’s no longer science fiction.  If you’ve uploaded a photo to try on a pair of glasses or check yourself out with a different hairstyle, you’ve used a form of the technology.  Marketers are taking advantage, too, using facial characteristics like gender or age to serve up targeted ads in retail spots.

But you don’t have to have a C+C Music Factory cassette in your Walkman to realize that when it comes to consumer protection, facial recognition is one of those "Things That Make You Go Hmmm.”  (Sorry, but that’s as close to a contemporary music reference as we can manage.)  In December 2011, the FTC sponsored a forum, Face Facts, to start a dialogue about facial recognition technology.  In addition to feedback from speakers and attendees, we got more than 80 public comments, ranging from “OMG” to “Here’s a suggestion about addressing privacy concerns.”

Following up on that effort, FTC staff published Facing Facts:  Best Practices for Common Uses of Facial Recognition Technologies to continue the conversation.  You’ll want to read the report, but it boils down to this.  First, companies using facial recognition technologies should consider implementing the “privacy by design” approach outlined in the FTC’s March 2012 Privacy Report.  As part of that, businesses should develop reasonable security protections for the information they collect and think through issues raised by storage and disposal.  For instance, companies offering signs equipped with cameras using facial recognition technologies should give careful consideration about where they’re placed.  Two “uh oh” examples:  near health care facilities or places where kids hang out.

The report suggests several ways for companies to be transparent about what they’re doing and give consumers easy-to-figure-out choices.  For example, signs using facial recognition technology should make it clear that cameras are in use. Similarly, social networks using a facial recognition feature should give users clear notice – not something slipped into a dense privacy policy or buried in fine print — to explain how the feature works, the data it collects, and how the information is used.

The report raised at least two situations where the staff thinks companies need people’s affirmative express consent before collecting or using biometric data from facial images.  When the data is used in a way materially different from what people were told when the info was gathered in the first place, companies should get consumers’ express permission.  The staff also suggests that without an affirmative OK, companies shouldn’t use facial recognition to identify anonymous images of people to someone who couldn’t otherwise identify them.

New tech offers great potential, but do you really want some random person to be able to identify you without your permission when you’re walking down the street?  We didn't think so.

Looking for more information about what this could mean for your business?  FTC attorney Amanda Koulousias may have answers to some of your questions.