The Dutch Data Protection Authority (AP) has informed the supermarket industry about the rules regarding the use of facial recognition cameras via the trade association CBL. By providing information and intervening where necessary, the AP wants to prevent supermarkets from unlawfully using facial recognition.”Facial recognition is a tough tool,” said Monique Verdier, vice president of the AP. 'This makes it possible to follow people on a large scale. That may start with a supermarket, which can find out with just the push of a button how often you enter the store and what you buy. That ends with a situation that we are continuously monitored, with facial recognition in all shops and on the street. We must prevent such a surveillance society.”Moreover, it is about biometric data, just like fingerprints. The use of such sensitive data is in principle prohibited. However, recently there have been signs that various supermarkets want to use this technique. “That is why we are now pointing out the rules to the supermarket industry and intervening where necessary,” says Monique Verdier.In one case, where a supermarket entrepreneur already used this technique, the AP contacted the entrepreneur. As a result, that entrepreneur turned off the system.The letter to the Central Food Trade Agency (CBL) contains information about the use of facial recognition. The AP asks the trade association to share this information with the members. The AP will continue to inform the supermarket industry about the rules for facial recognition and also intervene where necessary.The General Data Protection Regulation (GDPR) places strict requirements on the processing of biometric data, such as fingerprint or iris scans and voice or face recognition.According to the GDPR, biometric data is special personal data. Under privacy law, the use of biometric data to identify someone is in principle prohibited. This also applies to facial recognition.There are two exceptions to this prohibition:The filmed people have given explicit permission;facial recognition is used for security or authentication purposes, to serve an 'important public interest'.Such an important interest can, for example, be the protection of a nuclear power plant. However, the security of a supermarket is not so important that biometric data can be processed for this.
Netherlands warns supermarkets on facial recognition rules
