Facial Recognition Software Pros and Cons in the Privacy Age

The meteoric rise of open-source facial recognition repositories and GPU-based machine learning has progressed faster than any legislative curbs or ethical and political guidelines could address it over the last five years. Estimated at $3.4 billion USD in 2019, the global market is currently forecast to rise to over $10 billion by 2027¹. 

The key areas that have galvanized the sector leader in computer vision software development over the past five years are biometrics, security applications, marketing and attendance systems — all bolstered by recent advances in machine learning and the increasing use of lightweight mobile deep learning frameworks.

We'll examine some of these individual markets, but we'll also acknowledge that the facial recognition landscape is changing rapidly. The good news is that these changes are historically inevitable, and usually lead to a stable and more profitable sector with stricter legislation but fewer risk factors for new investors in the technology. 

There's significant evidence that the 'wild west' years of facial recognition are drawing to a close under pressure from privacy campaigners and from the politicians tasked with juggling the interests of the state with the will of voters. 

Over the next five to ten years, increasing regulation is set to rationalize research and deployment of facial recognition technologies into a more stable state. New legislative boundaries are likely to cut away the early opportunists but leave behind a regulated industry that's ready to enter a more traditional business cycle of competition and conglomeration. 

Besides the extent to which the advent of COVID-19 has altered the facial recognition landscape with intelligent video analytics, other political and social pressures have begun recently to bear down on its use, both in the private and public sector: 

• In June 2020, IBM sent a letter to the United States House of Representatives, stating that it will no longer supply facial recognition or analysis software and urging a “national dialogue on whether and how facial recognition technology should be employed by domestic law enforcement agencies”²¹.
• Public calls increased for a general moratorium on facial recognition technologies until suitable regulation is established²², after the Washington Post revealed that the Federal Bureau of Investigation and Immigration and Customs Enforcement (ICE) transposed state driver’s license records into a facial recognition database without consent²³.
• In June 2020, Microsoft imposed a ban on the sale of facial recognition technologies pending clear and agreeable legislation²⁴.
• The trial rollout of a facial recognition scheme by the UK's Metropolitan Police together with controversies about the force's ad-hoc use of facial recognition²⁵, has increased calls for more oversight mechanisms²⁶.
• At the same time that prominent privacy regulators warn that AI-based facial recognition could become illegal in the European Union²⁷, pan-European police forces are pushing for an EU-wide facial recognition database²⁸. 

The current lack of consensus is creating a turbulent and volatile landscape for business investors in facial recognition. When even a notable company such as IBM abandons it as a PR liability, under pressure from shareholders responding to public sentiment²⁹, we can assume that automated facial ID technologies have arrived at a critical juncture. 

Though legislation around facial recognition technologies is in flux around the world as well as within the individual states of the US³¹, a rigorous approach to data governance and a thorough acquaintance with local and national laws is fundamental to the longevity of a business facial recognition deployment.

Consult your national and, where applicable, state's legislature around privacy and data governance where it relates to facial recognition technologies. Stay aware of pending bills and amendments that may change the regulations at some future date.

Research current case studies of facial recognition deployments in the private and the public sector, and acquaint yourself with clauses in recent legislation which facilitate implementations. These might include projects in the interests of national security, or where the use of facial recognition has been officially acknowledged as non-challengeable, such as in workplaces where facial recognition is included in the limited right-to-privacy of employees; prisons and other state institutions; educational environments; and experimental scenarios where the subjects have specifically opted in to facial recognition, and where such exceptions are permitted by local and national laws.

Even where current regulations may not require it, your facial recognition project should have accessible, human-readable policies around data retention, which in turn should fall in line with at least the minimum requirements of applicable law for your area.

Provide mechanisms where users can be apprised of the facial recognition data they have generated, and means by which the users can delete their data and/or opt out of the facial recognition scheme. Even if there is no current legal necessity to provide this functionality, it may be required in the future and will be far easier and cheaper to implement (and hide) at the start rather than retrofit if it should be needed later.

Implement a comprehensive and secure logging system in accordance with any prevailing laws that may specify policies around scope, granularity and retention of logs for the use and passage of facial recognition data.

A transparent approach to the journey of users' facial recognition information is essential. With the exception of sub judice requests from authorities, or where requirements for data retention may have expired, it should remain possible to deliver a complete account of where and when facial recognition data has been shared with parties included in the terms of an opt-in, or more generally under prevailing local and national laws.

Most goal-oriented facial recognition projects are in search of a relevant subset of surveilled subjects, whether the aim is marketing (most likely buyers), security (most likely offenders), or any other sector.

However, the National Institute of Standards and Technology (NIST) has identified 'empirical evidence' of racial and gender bias among some of the most popular algorithms and datasets³², while individuals of color have been falsely identified by facial recognition systems used by authorities³³.

Where facial recognition is a subset of object recognition/segmentation, the PR nightmares can multiply: Google was put in an uncomfortable position after its own facial recognition software defined two ethnic subjects as 'gorillas'³⁴.

It's inevitable that the goals of a facial recognition program will drill down to 'median' subjects, who may or may not have any particular characteristics in common among themselves. But it's essential to ensure that your tools and dataset development techniques are engineered to be impartial. Don't aim for results that you're already expecting and ensure any eventual distilled data were developed neutrally, being ready to demonstrate it later if necessary.