If holding a photograph is permitted can a company use facial recognition? If I've given a company permission to hold an image of me - for a photo ID card, for example. Do they need any extra permissions to use facial recognition software? The facial recognition software need only use the reference photograph I've already given them permission to and any CCTV is already recording all visitors/customers anyway. As a little background as to why I wondered about the legal issues behind this: There is plenty of regulation around other methods of identification ( see Protection of Freedoms act which covers fingerprints and DNA), with facial recognition being an automated, silent version of these forms of identification it made me wonder if any similar regulations covered the use of photographs. Edit: Initially I was only interested in the UK but I would be interested to hear about regulations within other countries
The company would likely require explicit consent for using facial recognition algorithms. The GPDR considers certain activities to be processing of “special categories” of personal data (Art 9 GDPR). One of these categories is “biometric data for the purpose of uniquely identifying a natural person”. Such processing activities are prohibited unless an exception applies. Facial recognition uses biometrics to identify a person, so it's prohibited by default. There are, of course, many exceptions. Art 9(2) GDPR contains a list of general exceptions which allow special categories data to be processed. In UK law, specific conditions for these situations are given in Schedule 1 of the Data Protection Act 2018. Whether any exception could apply depends a lot on the purpose for applying facial recognition, e.g. if it is necessary in a medical context or if it is truly necessary in an employment context. The most interesting exception in the context of video surveillance would be Art 9(2)(f): processing is necessary for the establishment, exercise or defence of legal claims However, necessity is a fairly high bar to clear. This exception cannot be used to pre-emptively scan a database of images in the hopes that it might find something. In contrast, it might be permissible to use facial recognition to confirm a suspicion. But here, there's a big caveat in that most facial recognition software cannot provide reliable results for less than ideal pictures (i.e. anything other than a well-lit frontal portrait of the face), and that such software is known to produce biased results. Thus, the use of facial recognition by private companies is still questionable. If none of the exemptions in the GDPR/DPA clearly applies, then only the Art 9(2)(a) exception is left over: the data subject has given explicit consent to the processing of those personal data for one or more specified purposes A notable example of a company illegally performing facial recognition is Clearview AI. Multiple data protection authorities have announced fines, including the UK's ICO: in late 2021, the ICO announced the intent to issue a GBP 17M fine for, among other things, failing to meet the higher data protection standards required for biometric data. This answer applies to private-sector data controllers, i.e. ordinary companies. Different rules can apply in the public sector, in particular for law enforcement agencies.
I'm a notary. If someone showed me a marked-up license, I'd refuse to perform the notarization, and make a note of the persons name and phone number, to make sure I would never make another appointment with the person. Is there a law that says I have to refuse? I don't think so. Is there is a law that says I can refuse if I have any doubts about the person's identity? Absolutely.
You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are already allowed to because of the exceptions, they have to - under GDPR - assume you don't want them to process your data, and thus have to ask you.
You acted illegally in assaulting your fellow student. When you are in public, a person can legally take your picture, and you are not allowed to assault a person because you do not like their legal actions. Any degree of force is excessive except in certain responses to illegal fource, and even the threat of force is excessive. You also have no right to demand that a person prove that they didn't take your picture, and certainly no right to enforce that demand with physical violence.
Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our legal team and as a result actually created a product to process deletions. Personal data from users/customer is carried for lots of reasons, not just marketing. What if you're asked to delete data that is needed to bill customers, information that may be relevant to a legal case or information that needs by law to be retained for the purposes of audit? GDPR does not make it illegal to carry personal information, it simply needs you to justify why you are keeping the information - inform the named person about this and provide them with a timescale for deletion. For example if you are required by law to store a record of emails to document the work done, but the user asks you to delete that information. You would be entitled to keep that information but only for the purposes of maintaining that audit trail. You would delete all associated customer data that was unnecessary such as CRM info, payment details etc.. but could keep the audit trail. The proper way to respond to the user's deletion request would be "your data will be kept in a secure server for the purposes of maintaining an audit trail for x amount of time. Once this time has elapsed it will be deleted. If you are unhappy with our use of this data please contact our data officer". GDPR isn't designed to catch you out - if you have a legitimate reason to keep that information then you are entitled to. The law was designed to stop marketers and advertisers hoarding huge amounts of information, as well as undermine Google/Facebook's duopoly on our personal information.
Bringing fair use into this sounds iffy if you are partnering -- that is a commercial relationship which should be defined. If they did send you a file with their logo for a specific purpose, you can assume that you are allowed to use it for that specific purpose. If they did not send you the file, you can assume that they did not give you permission, or they would have included the file ...
Yes Companies can own companies - that’s what subsidiaries are. On a practical level, you know this is true because you actually have an example. Companies House would not have allowed its registration (barring error) if it was illegal. Why can’t it open a bank account? Banks (or any other business) can choose who they will and won’t do business with. Unless it’s discrimination on the basis of a protected characteristic, it’s not illegal. Since juridical persons don’t have protected characteristics (apart from nationality) it’s virtually impossible to illegally discriminate against them.
Most likely yes if you are subject to UK or EU laws: The EU ePrivacy directive and implementing laws such as PECR in the UK require that you obtain consent before accessing information on a user's device, unless that access is strictly necessary to perform a service requested by the user. Cookies and similar technologies such as LocalStorage are stored on the user's device. Analytics are not strictly necessary to display a website. Thus, you need to obtain valid consent before setting any analytics cookies. GDPR and ePrivacy/PECR have some interactions: Even though the cookies might technically be set by GoSquared, you as the website operator are responsible for compliance. You are the data controller, the third party analytics are usually a data processor who only process data on your behalf. You must ensure that the data processor is compliant. Even if they were a joint controller you'd be responsible for what happens on the website (relevant precedent is the Fashion ID case). While ePrivacy originally had a fairly weak concept of consent (e.g. “by continuing to use this site, you consent …”). However, the GDPR updated the definition of consent, so that valid consent must be freely given, informed, actively given, and specific. If you set cookies for different purposes in addition to analytics, users should be able to give or withhold consent for analytics independently from other purposes. Since consent must be actively given, consent is never the default, e.g. pre-ticked checkboxes are not compliant (relevant precedent is the Planet49 case). Like Google, GoSquared stores data in the US. You are causing personal data to be transferred into the US, which is an international transfer. Before it was invalidated earlier in 2020, such transfers were easy to do under the Privacy Shield adequacy decision. Now, such transfers are only legal if you sign SCCs with your data processor, and your risk assessment indicates that your user's data is sufficiently safe there, despite your processors potentially being legally unable to comply with the SCCs. Fortunately for you the UK's ICO has taken a more industry-friendly stance on this matter than other countrie's data protection agencies. Why do so many websites use Google Analytics (GA) without requesting proper consent? A variety of potential reasons: They are actually non-compliant. After all, GA is not GDPR-compliant in default settings, and Google doesn't do a good job of providing essential information. Many data protection agencies have indicated that cookie consent enforcement is not their focus. GA can be used without using cookies/LocalStorage/…, and thus without requiring consent under ePrivacy or PECR. The websites might not be subject to EU or UK laws such as ePrivacy.