Facial recognition and artificial intelligence work together to create a safety technology that is increasingly popular in many sectors and even in our daily lives. But how does facial recognition work and what are its pros and cons?
WHAT IS FACIAL RECOGNITION?
Today we are well aware of the close relationship between facial recognition and artificial intelligence. Facial recognition, certainly among the most innovative and revolutionary technological inventions of our time in the field of ICT research, is a biometric technique that serves to uniquely identify a person on the basis of his/her facial contours.
Among the most popular facial recognition techniques are generalised facial recognition and adaptive regional facial recognition, which work on the basis of the different nodal points of a human face and help in identifying the person.
Artificial intelligence helps facial recognition because it is a form of intelligence typical of a smart system, which is created by trying to recreate a “human” intelligence mixed with the features of machines intelligence.
HOW DOES A FACIAL RECOGNITION SOFTWARE WORK AND WHAT ARE ITS TECHNOLOGIES?
Generally, facial recognition software is based on non-quality 2D images, i.e. flat images of the face that do not provide valid identification characteristics. Using a 2D image, a device is not able to recognize the length of the nose or the prominence of the forehead, but is based on brightness. In fact, facial recognition is unreliable in low light conditions.
3D facial recognition
3D technology can solve the problem. 3D facial recognition is achieved through a technique called “lidar”. Face scan devices cast a laser pulse onto the face, which is filmed by an IR camera within the device. In this way the tool calculates how long it takes the IR light to bounce from the face to the device.
It uses this information to create a unique depth map of the entire face, to increase the accuracy of the software and decrease the possibility of error.
THE THERMAL IMAGING CAMERA FOR FACIAL RECOGNITION
By using a thermographic camera that does not emit IR light but detects that emitted by objects, it is possible to detect also subtle differences in temperature. There are several ways to identify a face using the thermal imaging camera, but these are incredibly complicated techniques. Let’s see together why they are so complicated:
- a thermal imaging camera needs to take multiple photos of a face, via long waves that provide more detail on the subject
- IR images can also be used to extract the formation of blood vessels in a person's face, for example to use them as unique facial fingerprints. But also, to find the distance between the facial organs or to identify bruises and scars
- the composite image created using multiple IR images can be compared with a facial database to identify the subject
- thermal facial recognition is usually used in the military field
- thermal imaging does not work well during the day and does not have many possible fields of application
All types of facial recognition on the market
Let’s figure out how facial recognition works, and also the many facial recognition apps on the market today, with the three applications listed below:
- the "basic" facial recognition is that used by the Instagram or Snapchat filters, which uses the smartphone's camera and algorithms to search for the characteristics that define a face
- device unlocking the with the face is possible thanks to the ability of the devices to take a photo of the face and measure the distance between its distinctive features. Thus, when we try to unlock the phone with our face, the system measures and confirms the identity we set. Think, for example, of Apple's Face ID
- the identification of a stranger for security, advertising or police reasons, takes place through the use of algorithms that use an extended database of faces that time after time associate different profiles with the one examined
THE PROBLEMS WITH FACIAL RECOGNITION
Australia is the country that most of all makes massive use of facial recognition. Starting from the photo taken to obtain a driving license or to issue/renew the passport. A federal bill allows government agencies and private companies to use documents uploaded to the national database for facial recognition. Such a measure should decrease identity theft.
On the other hand, those who obtain the passport sign a form to authorise the use of the photos for biometric correspondence. For “privacy advocates” the benefits of this system do not justify intrusion into people’s private lives. The highly invasive method for facial data collection also includes video surveillance.
THE GDPR FOR FACIAL RECOGNITION
The GDPR is the set of rules for regulating the use of facial recognition and massive biometrics. Here are the law articles related to it:
- art. 9.1: the sensitive data to be protected are personal data such as ethnic origin, political opinions, religious beliefs, union membership and so on
- art. 4 no. 14: biometric data are personal data obtained from technical treatment and which allow or confirm the univocal identification of that person
- recital 51: the processing of photographs falls within the definition of biometric data only if these are processed through a specific technical device, which allows the univocal identification of a natural person
To legally process biometric data, it is necessary to use one of the legal bases provided for Art. 9.2, or the explicit consent of the interested party.
CONSENT FOR THE PROCESSING OF PERSONAL DATA
Explicit consent for the processing of personal data is required in certain circumstances in which serious data protection risks arise, such as in the case of facial recognition. To obtain consent, an explicit unequivocal declaration by the interested party is needed, perhaps in the form of a written declaration signed by the interested party.
In the online context, the interested party can give consent via an electronic form via e-mail or by using an electronic signature. Obviously, the interested partis can withdraw their consent at any time, without prejudice to the validity of the consent before the revocation.
THE IMPACT ASSESSMENT
Impact Assessment is essential to reduce the risk of disclosure of personal data in facial recognition. It is an independent evaluation made by the Data Controller to analyse the need and risks of the treatment itself. It is mandatory in these cases:
- in evaluating personal aspects based on automated processing, including profiling, in the context of decisions that have legal effects
- in the presence of treatment of particular categories of personal data, for example data relating to criminal convictions
- for systematic large-scale surveillance of a publicly accessible area, such as video surveillance
To determine if a treatment is carried out on a large scale, reference must be made to the number of interested subjects, the volume and type of data, the duration and geographic scope of the treatment activity.
The Impact Assessment must contain the following documents:
- systematic description of the treatments envisaged and the purposes of the treatment
- assessment of the need for treatments in relation to the purposes
- risk assessment for the rights and freedoms of data
- measures and guarantees envisaged to deal with risks and guarantee the protection of personal data
HOW TO GUARANTEE THE SECURITY OF PERSONAL DATA
To protect data online and digitally, they need to be completely anonymous, for example by removing the name before they are recorded in a database. The data anonymisation software creates a high level of security, but alternatively there is pseudonymisation. It is a technique that prevents data from being attributed to a specific person without the use of additional information, stored separately and subject to technical guarantee measures.
Among the measures adopted by the GDPR there are:
- a Data Loss Prevention strategy
- the creation of a Disaster Recovery plan
- a GDPR compliant data backup policy
Privacy and facial recognition
The Swedish privacy authority has sanctioned a high school for having implemented one of the most original systems for biometric recognition by using it to record the presence of students with facial recognition technology. The presence of students was captured and recorded through smart cameras, to automate daily operations and save the customary 10 minutes, as well as around 18k per year.
The biometric data were collected by the cameras in the form of photographs of the students’ faces and stored on a computer without an internet connection. Explicit consent was collected from the student’s legal representatives, but nevertheless no DPIA or consultation was carried out. This is the reasons why, according to the Stockholm privacy authority, the school has violated some articles of the GDPR.
