This of course complies with all the necessary consents and legislation:
Quoted from a well-informed comment at the Guardian:
http://www.theguardian.com/business/2013/nov/03/privacy-tesco-scan-customers-faces#show-all
"What I don't understand is how this can possibly be in accordance with the data protection principles - its obvious that in order to use this technology the system must process your individual data... therefore...(DP principles in bold)
The individual who the personal data is about has to consent to the processing.
Unless Tesco installs a process whereby I can consent to the facial recognition technique I fail to see how this can happen
The processing is necessary:
- in relation to a contract which the individual has entered into; or
- because the individual has asked for something to be done so they can enter into a contract. Buying petrol from a Tesco store surely does not include the right for Tescos to gather information about me in order to process that information.
The processing is necessary because of a legal obligation that applies to you (except an obligation imposed by a contract). No contract I can see.
The processing is necessary to protect the individual’s “vital interests”. This condition only applies in cases of life or death, such as where an individual’s medical history is disclosed to a hospital’s A&E department treating them after a serious road accident - Surely not applicable
The processing is necessary for administering justice, or for exercising statutory, governmental, or other public functions.
Well even Tesco cant claim this status
The processing must also be in accordance with the “legitimate interests” condition.
The first legitimate interest requirement is that you must need to process the information for the purposes of your legitimate interests or for those of a third party to whom you disclose it.
What ‘legitimate interest’ can Tesco claim here, apart from it helping their sales?
The second requirement, once the first has been established, is that these interests must be balanced against the interests of the individual(s) concerned. The “legitimate interests” condition will not be met if the processing is unwarranted because of its prejudicial effect on the rights and freedoms, or legitimate interests, of the individual. Your legitimate interests do not need to be in harmony with those of the individual for the condition to be met. However, where there is a serious mismatch between competing interests, the individual’s legitimate interests will come first.
I regard my right not to have information about myself processed in this way, simply because it may help Tescos sell more of its products.
Finally, the processing of information under the legitimate interests condition must be fair and lawful and must comply with all the data protection principles. Which plainly it does not.`
But will we see the Data Protection Commissioner step in and say to Tescos, now look here your proposal breaks most of the DP principles? Sadly like other regulatory bodies they will probably act like toothless fairies."