Who Owns YOUR Face?
Face Recognition and Privacy
As one of the founders of Sensible Vision, I’d like to touch on a topic getting a lot of media attention - face recognition and privacy. Sensible Vision has been actively involved in face recognition technology and products since 2005 and I have seen a dramatic increase in the types of applications using face recognition.
In general, face recognition use falls into four categories, ranging from “full privacy” to “no privacy.” The key factors in determining privacy issues are how the user's face is acquired, where it is stored, and who has control of the resulting information. The categories are:
Full privacy - Explicit consent with full control and ownership by the individual.
Explicit consent with another party having control and/or ownership.
Implicit consent with another party having control and/or ownership.
No Privacy - No consent with another party having control and/or ownership.
Our product, FastAccess, uses face recognition to replace passwords and provide continuous security, which places it in the first category (explicit consent, full control/ownership). It offers full privacy because each user explicitly authorizes FastAccess to learn their face. By default, FastAccess only records images of a user’s face if they were successfully recognized and logged into the computer or secure website. In terms of ownership, all of a user’s images and templates (the numeric representation of the authorized user’s face) stay in an encrypted format on their local computer, tablet, or phone - never leaving their device or their control.
By their nature, most other applications using face recognition don't lend themselves to the same standards of privacy. This is why the current discussions on face recognition, privacy, and its potential misuse are so important.
A few years after we publicly introduced FastAccess Face Recognition in 2006, companies like Facebook started offering face recognition for an entirely different purpose: tagging of uploaded personal photos. Faces of people who had not explicitly agreed were being identified, cataloged, and stored without their knowledge. Initially, this was not much of a problem because most tagged photos were of friends and family. However, people and regulators in Germany grew concerned about how publicly accessible this new face data was becoming. The rest of Europe soon followed.
Facebook’s initial usage of face recognition is an example of the third category (implicit consent, no control/ownership). A user did not have to give consent for the recognition and tagging to take place, they simply had to be using Facebook itself - and Facebook owned and controlled the resulting data. What would Facebook do with the face data…without the user's explicit consent? Later, Facebook implemented controls to make users aware when they had been tagged and to allow them to “accept” the tagging. This moved Facebook’s face recognition into the second category (explicit consent/no control ownership).
In either case, many of these tagged images exist on public pages, making it easy for anyone to associate a user's face with their name. This allows a person to be identified without consent while walking into a retail store simply by snapping their image – an example of the fourth category (no consent, no control/ownership).
Face recognition without the user's express consent does bring up important privacy and ethical issues and deserves further discussion and, ultimately, appropriate regulation. In contrast, when a user gives their express consent and maintains ownership and control of their facial identity data, privacy issues are not a concern.
Next time I will talk in more detail about how face recognition actually works.
George Brostoff, CEO, Sensible Vision, Inc.