Face and Emotion Recognition on Commercial Property under EU Data Protection Law

Abstract

This paper integrates and cuts through domains of privacy law and biometrics. Specifically, this paper presents a legal analysis on the use of Automated Facial Recognition Systems (the AFRS) in commercial (retail store) settings within the European Union data protection framework. The AFRS is a typical instance of biometric technologies, where a distributed system of dozens of low-cost cameras uses psychological states, sociodemographic characteristics, and identity recognition algorithms on thousands of passers-by and customers. Current use cases and theoretical possibilities are discussed due to the technology's potential of becoming a substantial privacy issue. First, this paper introduces the AFRS and EU data protection law. This is followed by an analysis of European Data protection law and its application in relation to the use of the AFRS, including requirements concerning data quality and legitimate processing of personal data, which, finally, leads to an overview of measures that traders can take to comply with data protection law, including by means of information, consent, and anonymization.

The Personal Data Protection Mechanism in the European Union

“…The legal status of personal data protection is being unified, and a digital market for dissemination, exchange, control, supervision is being formed. "The development of the digital market deepened an imbalance in the relationship(s) between traders and consumers, leading to new questions as to the ethical boundaries of marketing and retailing" (Lewinski, Trzaskowski and Luzak, 2016). In June 2020, the European Commission published a report on the evaluation of the GDPR, which in particular assesses the GDPR's effectiveness in terms of functioning of the rules for the transfer of personal data to third countries and international organizations.…”

“…This raises the issue of the effectiveness of the personal data protection mechanism in the EU. Given that the studies mostly cover the mechanisms of action of the EU Data Protection Directive (DPD) (Guinchard, 2018;Ilina, Miloradov and Kovaltchuk, 2019;Lewinski, Trzaskowski and Luzak, 2016), it is important to identify the features of the new innovative mechanism for personal data protection management in the EU.…”

Novel retail technologies and marketing analytics

“…Research shows the benefits of measuring consumer emotions and attention during visits to retail locations and its potential to provide helpful insight to marketers (Lewinski et al 2014(Lewinski et al , 2016. Studies also note that automated facial recognition systems can assess objective emotion responses with near-human accuracy rates (Lewinski et al 2014(Lewinski et al , 2016. This technology can also be used to help with counting people, monitoring visitor movement and attraction patterns, and tracking and profiling (Lewinski et al 2016;Liu et al 2017).…”

“…Studies also note that automated facial recognition systems can assess objective emotion responses with near-human accuracy rates (Lewinski et al 2014(Lewinski et al , 2016. This technology can also be used to help with counting people, monitoring visitor movement and attraction patterns, and tracking and profiling (Lewinski et al 2016;Liu et al 2017). However, these practices may infringe on an individual's right to their own image, which is protected as part of the right to privacy.…”

“…Retailers utilize the latest technology for obtaining consumer data and marketing analytics including IP addresses, geo-fencing data, beacons, behavioral data from the Internet of Things, automated facial recognition data, and radio frequency identification (RFID) tags (Andrews et al 2016;Blázquez 2014;Lewinski et al 2016;Luo et al 2014;Roh et al 2009). Studies show the value of geo-conquesting, a method of competitive locational targeting enacted by sending mobile promotions to consumers near a competitor's location (Fong et al 2015).…”