Facial Recognition Proliferation: Litigation and Legal Implications of Biometric Technologies

• Publication year: 2021

Martin T. Tully and Debbie Reynolds^*

Abstract: The digital age has ushered in a period of tremendous technological development and data collection capabilities. With them has come the increasing capture and use of biometric data—fingerprints, retina scans, and voice and facial identification. Because facial data can be easily captured and it can be used in myriad applications, facial recognition technology is seeing widespread adoption. For its many advances, it also raises privacy concerns. Laws will continue to be enacted to regulate its use and minimize harm to individuals, and litigation will only increase. This article addresses these issues and more.

What Is Facial Recognition? How Does It Work?

Facial recognition (FR) is the ability of a technology to recognize a face, capture an image of a face, then use that image to map unique characteristics for potential matches in databases. FR can identify people, authenticate their identity, and enhance diagnostic imaging. It is being used in the context of health care, employment, travel, security, and law enforcement. FR comes in different flavors for different applications, and the technology behind it can vary. One example is FR technology for ingress and egress or visitor management for a facility. This instance is not about identifying people, as you might see in law enforcement or a security setting. Instead, it is about authentication, verifying that those coming into a facility are who they say.

Some FR technology uses a scanner to identify 4,500 different points of facial geometry to create a map of a person's face. The application does not necessarily store photos of faces; it generates and stores a unique, algorithmic representation of faces. Think of it as a hash value for that individual. The hash value can then recognize that person when they return to a facility after initially registering. "Ah, you're Mary, the FedEx driver. You are authorized to go to Suite 501 and deliver this package to Acme Corporation because you previously registered yourself here in that capacity." Notably, the hash value in this example is often encrypted and is not personally identifiable information by itself; it is useless outside the visitor management system. In this situation, if there was unauthorized access to or disclosure of the hashed representations of facial geometry, they could not be used to identify any individuals unless the unauthorized recipient also had access to both the registration system and the registered individual. In this regard, it is vital to understand how the particular FR technology works when considering its privacy implications.

[Page 31]

Why Is Facial Recognition Such a Popular Biometric Identifier?

FR is popular because it can be relatively inexpensive to implement; it is a contactless and unobtrusive method of data capture and identification. You do not need special equipment; the placement of a digital camera connected to the proper software is all that is required. Even before COVID-19, we were accustomed to checking in at lobby kiosks to have our picture taken for a temporary ID badge. That same equipment can capture facial geometry to generate and recognize a unique representation of a person's face for authentication. The hardware was already there.

Similarly, there are numerous public and private cameras deployed across most cities for security and other purposes. Again, the hardware is in place, so adding the necessary FR software is not a heavy lift.

What Are the Growing Commercial Uses of Facial Recognition Technology?

One common commercial application of FR is employee timekeeping. With the old-fashioned time clock, factory workers had to punch in and out. Sometimes a worker would ask a co-worker to do this for them. The problem with a punch card is that you cannot verify the person handling it. Companies have started using biometrics with time clocks, using either fingerprints or FR. When employee Jane Doe comes to work in the morning and leaves later in the day, the company knows, based on the biometrics, that it really was her.

[Page 32]

With visitor access management, FR allows visitors and delivery services, once registered, to essentially check themselves in later because the software can be programmed to generate a badge that will...