3 Applicable legal framework

easily a system can be tricked by, for example, fake face images (called ‘spoofing’) are important particularly for law enforcement purposes.”7 .

27. In this context, the EDPB considers it important to recall that facial recognition technologies, whether used for the purposes of authentication or identification, do not provide for a definitive result but rely on probabilities that two faces, or images of faces, correspond to the same person8 . . Numerous studies have also highlighted that such statistical results from algorithmic processing may also be subject to bias, notably resulting from the source data quality as well as training databases. 28. It is also important to highlight that human intervention, in assessing the results of facial recognition technology may not necessarily provide for a sufficient guarantee in respecting individuals’ rights and in particular the right to the protection of personal data, considering the possible bias and error that can result from the processing itself. In addition, it is important to critically challenge the results of FRT during human intervention. Furthermore, one should also highlight the impact of facial recognition technology on other fundamental rights such as the respect for private and family life, freedom of expression and information, freedom of assembly and association, etc. 29. It is therefore essential that the reliability and accuracy of facial recognition technology is taken into account as criteria for the assessment of compliance with key data protection principles, as per Article 4 LED, and in particular when it comes to fairness and accuracy. 30. While highlighting that high-quality data are essential for high quality algorithms, the EDPB also stresses the need for data controllers, as part of their accountability obligation, to undertake regular and systematic evaluation of algorithmic processing in order to ensure in particular the accuracy, fairness and reliability of the result of such personal data processing.

31. The use of facial recognition technologies is intrinsically linked to processing of personal data, including special categories of data. Moreover, it has direct or indirect impact on a number of fundamental rights, enshrined in the EU Charter of Fundamental Rights. This is particularly relevant in the area of law enforcement and criminal justice. Therefore, any use of facial recognition technologies should be carried out in strict compliance with the applicable legal framework. 32. The following information is intended to be used for consideration when assessing future legislative and administrative measures as well as implementing existing legislation on a case-by-case basis that involve FRT. The relevance of the respective requirements varies according to the particular circumstances. As not all future circumstances may be foreseen, it is only considered to be providing support and not to be interpreted as an exhaustive enumeration.

7 Facial recognition technology: fundamental rights considerations in the context of law enforcement, EU Fundamental Right Agency, 21st November 2019. 8 This probability is referred to as “confidence score”.