Hungry for Data

AI systems that recognize faces can make our world more secure, says legal scholar Florent Thouvenin. But they can also make us feel like we’re under constant surveillance. That’s why it is important to legally regulate the use of facial recognition technology.

by Roger Nickl; translated by Philip Isler

Florent Thouvenin, AI-supported applications such as Clearview can recognize and identify millions of faces. What’s going on?

Florent Thouvenin: As with many other uses of artificial intelligence, the main goal is to emulate a human skill. But since AI technology can save and process much more data than the human brain, facial recognition systems can in theory identify everyone on the planet. All they need to do this is sufficient data.

Facial recognition is increasingly being used in public spaces, e.g. in airports. Is this a good idea?

Thouvenin: Using facial recognition in public spaces is mostly about ensuring security and searching for wanted people. In principle, AI-supported facial recognition isn’t doing anything that we haven’t previously been doing using CCTV and personnel. But these systems are much more efficient than people, at least in terms of quantity. However, they are also error-prone, and for this reason alone we should use them with caution.

How so?

Thouvenin: Facial recognition technology processes vast amounts of personal data, and this means that data protection regulations must be observed. Among other things, these regulations state that personal data may only be processed if this is transparent to the people affected. Unlike other biometric data, such as fingerprints, this isn’t always the case with facial recognition. Some cameras are deliberately installed where they’re impossible to miss, but quite often that’s not the case. Even if the cameras are obvious, there is the question of whether it’s enough for people to be aware that they’re being recorded, or whether they also need to be informed that the recording will be used for facial recognition purposes.

What are the benefits of facial recognition technology?

Thouvenin: That depends on what you use it for. If you use it to search for a wanted person in a public space, for example a train station, then I think facial recognition can definitely be useful. Or if it’s used at border crossings. However, it’s quite a different thing to use facial recognition purely as a means of identification, for example to re­place the PIN on your smartphone. I think in such cases, it’s fair to question how great the benefit is. But with the right technological set-up, you can minimize risks here, too. The same goes for using the technology to recognize people in pictures, for example on Facebook or with smartphones. The technology could also be used in other areas. Just imagine if you could go shopping, put the items in your bag and simply walk out the shop without having to go to the checkout, since cameras would recognize you as well as what you're buying, and the money you owe would be charged directly to your account. I'm sure there are many people who would welcome this.

What about the potential for abuse if facial recognition tools are used by governments and businesses?

Thouvenin: This threat exists. In principle, there are data protection regulations to prevent abuse. Specifically, personal data may not be used for purposes other than those they were originally collected for. So for example, recordings made by CCTV in the public sphere may not be used to create comprehensive movement profiles for individual people with the help of facial recognition technology. However, we have to admit that these data protection provisions are often ignored. The EU’s General Data Protection Regulation, which has been in force since 2018, has done little to improve the situation and the revised Swiss data protection act isn’t likely to significantly change the situation, either.

Are we hurtling towards a Big Brother-style society?

Thouvenin: No, I don’t think so. Regardless of the amount of data collected or the technologies used, such a society will only come about when a state wants to control its citizens as far as possible. Technology only provides the tools. But these tools open up new possibilities, which some people are then eager to explore. I don’t see any great danger of extreme surveillance among European societies, but even here gov­ernments are getting more and more hungry for data about their citizens. This is why we need clear rules that limit the authorities’ powers, and above all, we also need independent institutions – data protection agencies and courts, in particular – that monitor the state’s activities. The public discourse is another important aspect. We as a society should decide for ourselves how much surveillance we are willing to allow for the sake of our security, and where we draw the line to protect our privacy. This dis­cussion has to be held again and again, especially when new technologies emerge.

How should we deal with AI-based facial recognition technology, in political and legal terms?

Thouvenin: I’m generally quite cautious when it comes to calling for new technology to be regulated. It usually doesn’t make a lot of sense, since it’s not the technology that’s causing harm or creating risks, but the fact that it is applied in certain areas. Often these areas are already regulated, because they’re associated with special risks, for example in the pharmaceutical or automotive sector. So the main thing we ought to do, and rightly so, is to check if the existing rules are still appropriate, or whether they need to be adapted due to changes in technology. It’s often enough to make specific improvements, for example when it comes to allowing self-driving cars or determining who’s liable for damages caused by AI-based products. And the same generally applies to facial recognition. You can, however, argue whether it makes sense to have specific provisions for the use of CCTV cameras and the data they collect. Legislators could look to the regulations governing the surveillance of postal and telecommunication traffic for inspiration. According to these, law enforcement agencies may only access data stored by telecom providers for specific crimes, and only if this has been authorized by a court. The same approach could make sense when it comes to video surveillance and facial recognition technology.

How will AI-supported facial recognition technology continue to evolve?

Thouvenin: Facial recognition technology is likely to improve rapidly and therefore in­crease its accuracy. This is good news for the people using the technology as well as those affected by it, since it is in no one’s interest to have mediocre facial recognition systems. But the improved quality is likely to also expand the technology’s area of application. That’s why it will be all the more important to legally regulate the use of facial recognition technology.