The Article 29 Working Party has advised that social networking sites such as Facebook should get specific consent from users before suggesting to other users that photos those subsequent users are uploading to the site feature those users (providing the consent) by using facial recognition technology. Therefore, users who have not specifically consented to this technology and individuals who are not registered with the site will not have their names suggested to the photo uploaders. The Article 29 Working Party is made up of representatives of data protection regulators of each member state of the European Union.
Social networking sites can process the photos without breaching data protection law if that processing is being done to check whether consent has been obtained, but, once that check has been finalised, the site must delete that information.
Facebook currently uses facial recognition technology to suggest the names of people featured in photographs to the uploaders. The name tags used by the uploaders can be viewed by other Facebook users.
Aside from consent, the Article 29 Working Party said that the social networking sites would need to take adequate technical measures such as encryption while the images are being uploaded. They should also use technical controls to try to safeguard against the images being used by third parties for purposes for which the user had not consented. To add to the regulatory burden, the body added that compliance with EU data protection law also meant giving the data subjects sufficient access rights to their images and not storing more data than was necessary for the tagging purpose.
The Working Party’s opinion also included some comments on the use of facial recognition technology by search engine providers and gaming services.
The Opinion is not legally binding, but it is best practice to comply with it, particularly as it gives an indication as to the action that the regulators would take to enforce the law.
Paul Gershlick, a Partner at Matthew Arnold & Baldwin LLP, comments: “The Working Party has once again taken a strict pro-privacy stance in providing an opinion. This is similar to the tough line it took against social networking sites and others in its opinion last year on geo-location services. For more on that geo-location opinion, click here: http://www.mablaw.com/2011/06/article-29-working-party-geo-location-data/.”
