Call for law reform to regulate facial recognition technology

The use of facial recognition technology is becoming increasingly prevalent in Australia and globally. Case studies show facial recognition technology being deployed in a range of circumstances, with the practice facing scrutiny due to its potentially invasive nature ─ specifically, its ability to become a "mass surveillance" technology.

The University of Technology Sydney (UTS) is calling for a model law to regulate the development and deployment of facial recognition technology in Australia.

UTS cites the lack of legal guardrails currently in place to ensure facial recognition technology is developed and deployed in a manner that upholds basic human rights as recognised under international human rights law.

The model law and its features

A paper recently published by UTS, Facial recognition technology: Towards a model law, calls on the Australian government to legislate a model law to regulate facial recognition technology in Australia.

The model law would require developers and deployers of facial recognition technology to adopt a risk-based approach to the development and use of the technology. This is to address concerns that facial recognition technology (FRT) could become a means of "mass surveillance", be misused, and undermine other international human rights, such as freedom of association and assembly and freedom of expression and opinion.

Key features of the model law include the following.

Application

The law would apply to:

• a person (including an individual, corporation or other organisation) that uses or deploys a FRT application (FRT deployer); and
• a person that creates a FRT application (FRT developer)

Risk-based approach

FRT developers and deployers must complete a human rights risk assessment to assess an FRT application's overall human rights risk level. An FRT application would be given an overall risk rating of base-level risk, elevated risk or high risk.

Facial recognition impact assessment

FRT developers and deployers must complete a two-step facial recognition impact assessment process for their FRT application before it is deployed and used on affected individuals, unless an exception applies. The first step involves a use and risk assessment declaration. The second step involves a risk management declaration. All facial recognition impact assessments must be registered with, and published by, the regulator.

Technical standard

A technical standard for FRT applications used in Australia would be developed.

Enforcement and penalties

A regulator would be granted powers to oversee the operation of the model law. Civil penalties would apply to FRT developers and deployers who fail to comply with the requirements of the facial recognition impact assessment.

Conclusion

The case for reform is mounting given the privacy and human rights implications arising from the use of facial recognition technology.

It remains to be seen if the Australian government will act on the call to introduce facial recognition technology laws. The use of surveillance technologies and the collection and handling of sensitive information (such as face prints) is currently regulated by federal, state and territory privacy and surveillance devices laws. However, these laws have significant gaps and are often perceived to be lagging behind technological advances. Existing laws also do not fully consider the potentially invasive nature of facial recognition technology from a privacy and international human rights perspective.

At a minimum, a review of existing laws to assess whether there is a need for specific laws to address facial recognition technology is warranted. A more effective approach, both for industry and individuals, might be one of reform and harmonisation of existing laws.

Please contact our team of privacy and emerging technology lawyers to learn more about the use of facial recognition technology in Australia.

Photo by Spencer Whalen on Getty Images Pro.