Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, what recent assessment she has made of the (a) effect of increased use of facial recognition software on personal privacy and (b) the adequacy of existing legislation to protect personal privacy.

Government is committed to ensuring the responsible deployment of digital technologies, including facial recognition. The use of facial recognition has increased with advancements in technology and has implications for privacy. Facial recognition technology relies on the processing of facial imagery which is defined as personal data under the Data Protection Act 2018 (DPA) and the General Data Protection Regulation (GDPR). Its use is regulated by these laws.

This legislation imposes strict obligations on both individuals and organisations to process people’s data fairly and lawfully and to ensure that any data collected is held securely. There must also be a legal basis for processing data. The way in which personal data is collected and handled must be fair and transparent, and the data should be processed in a way which individuals would expect.

The DPA and GDPR are enforced independently of Government by the Information Commissioner's Office (ICO). Organisations that fail to comply may be subject to enforcement action by the Information Commissioner’s Office. The ICO is currently investigating facial recognition and its implications for privacy. The Commissioner recently published a blog on ‘Live facial recognition technology - data protection law applies’ which is available on the ICO website.

The Government has also recently established the Centre for Data Ethics and Innovation to provide independent and expert advice on the governance of data-driven technologies. The Centre will identify the measures needed to strengthen and improve the way data-driven technologies and AI are used. This will include promoting best practice and advising on how government can address potential gaps in our regulatory landscape. The Centre is currently looking at the use of facial recognition technology.