Kings Cross building site highlights the importance of GDPR ‘proportionality’

The Information Commissioner has launched an inquiry into the use of facial recognition software at a 23 hectare construction site next to Kings Cross station in London. The outcome could have repercussions not only for the use of increasingly controversial facial recognition equipment but also for clarity around what is deemed ‘proportionate’ under the Data Protection Act 2018 [DPA18] and GDPR.

The owners of the site – Argent and Hermes Property Management – have installed facial recognition CCTV cameras around the site where they also capture images of people in public spaces. They have issued a statement saying that the cameras are there “in the interests of public safety” and, perhaps less convincingly, “to ensure everyone visiting the site has the best possible experience”.

But Information Commissioner Elizabeth Denham has said she is “deeply concerned” about the growing use of facial recognition generally and has specifically said that the ICO will be investigating its use on this site.

The ICO has previously warned businesses using the software and associated technology that it must be “strictly necessary and proportionate” and have a clear basis in law. This is especially the case if it is done without people’s knowledge or understanding.

BCRP Comment

Facial recognition has long been a great area crying out for clarity but to a certain extent so too has the definition of ‘proportionate’. Clearly what is proportionate is inevitably a subjective decision and can vary depending upon the exact circumstances but it is difficult to see how this instance will pass the test. The DPA18 doesn’t include a legal basis for ‘everyone having the best possible experience’. The site is almost certainly not accessible to the general public so it is questionable whether there is any legitimate excuse for capturing their personal data.

One of the elements that seems to have been enhanced by the new data protection act is the concept of proportionality and it is incumbent on all BCRPs to constantly question whether the information they share with their members is proportionate under the legal basis of ‘legitimate interest’. One day those people that administer business crime reduction partnerships may find themselves standing in front of a clever barrister asking exactly that question and they had better have a good answer.