IT experts warn that facial recognition CCTV has no basis in law

Authorities are set to introduce facial recognition software in Paceville through the existing CCTV system but critics have warned that the use of real-time biometric tracking has no basis in law and called for caution.

Similar technologies introduced abroad have been met with resistance and civil rights have  raised various concerns over the creeping use of facial recognition technology to monitor crowds and hunt for criminals which they hold to be an intrusion upon the privacy of citizens.

On Sunday, MaltaToday reported that a new government company called Safe City Malta, part of the government’s public-private partnership arm Projects Malta, is planning to implement a controversial security system that will deploy facial recognition software to enhance safety and assist police officers.

But in a statement issued today, the Malta IT Law Association said that no such specific laws currently exist to allow the introduction of facial recognition technologies and these “should only be permitted when strictly necessary and must be subject to adequate safeguards laid down at law.”

The Malta Information Technology Law Association (MITLA) said facial recognition software applications and its impact on privacy is far higher than static surveillance cameras given that the processing of personal data, specifically biometric data, “is much more acute, automated and process-heavy.”

MITLA warned that the proposed technology often exposes accuracy deficiencies and the potential introduction of such technologies on a national scale “makes a local debate even more urgent.”

“Any introduction of facial recognition technologies, irrespective whether launched as a pilot project or not, will require the introduction of an ad hoc legislative framework which will carefully need to balance the fundamental rights and freedoms of the citizens with the obligations and duties of competent authorities in their fight against crime and the preservation of public order,” MITLA said.

However, the association cautioned that it reaching such a balance will not be easy given the risk posed by such technologies.

Facial recognition systems must comply with the rules laid down in the new EU General Data Protection Regulation (GDPR) which will come into force in May 2018. The processing of biometric data by law enforcement agencies needs to be carried out in line with the provisions of EU Directive 2016/680 on the protection of natural persons with regard to the processing of data by competent authorities for the purpose of prevention, investigation, detection or prosecution of criminal offences.