Facial recognition: the Government’s decree is delayed; the issue of unauthorised data use remains

Article 8 governs ‘Artificial intelligence systems for remote, real-time biometric identification for the purposes of prevention, as well as for the search for missing persons and victims of specific offences’.

The police may use real-time biometric recognition in public places to prevent specific threats and to search for missing persons or victims of abduction, human trafficking and sexual exploitation. The comparison may only be carried out using a database created ‘specifically for each purpose’.

The request may be submitted by the Chief of Police, the provincial commanders of the Carabinieri and the Guardia di Finanza, or by the heads of the central services. The decision rests with the Public Prosecutor of the district capital.

The authorisation must relate to a specific event or to the period strictly necessary. It may last for a maximum of fifteen days and may be extended, by means of a reasoned decree, for a further fifteen days. It must also define the area concerned and specify the persons being sought.

If these conditions are not met or authorisation is not granted, the system must be shut down. The data must be deleted and the results ‘must not be used’.

The provision, however, includes an exception for data ‘lawfully obtained on another legal basis’. And it is precisely here that the mechanism becomes unclear. The provision does not specify what these legal bases are, nor does it set out the circumstances in which the images may be retained despite the lack of the authorisation required for real-time biometric identification.

The risk is that a guarantee formulated in strict terms – immediate shutdown of the system, deletion of data and the results becoming unusable – may be undermined by a clause whose scope remains unclear.

It was the Data Protection Commissioner who formally raised the issue. In Opinion No. 531 of 14 July (drafted by Vice-President Ginevra Cerrina Feroni), which endorsed the draft but subject to conditions, it noted that ‘there remains, however, some uncertainty regarding the exemptions provided for in relation to the erasure of unlawfully obtained data’ and warned that the retention of data on the basis of a generically identified ‘other legal basis’ must be avoided, as this would result in a ‘substantial weakening of the safeguards provided for by Legislative Decree No. 51 of 18 May 2018’. Hence the condition: to limit the exceptions ‘to cases where only the conditions for lawfulness identified by the legislation are met’, with the requirements for retaining data ‘to be defined by law’.

The government, however, has not specified in the draft the individual cases in which data retention would be permitted. The text merely refers to Legislative Decree No. 51 of 2018 – the very same decree in which the Data Protection Authority considered the safeguards to have been weakened – leaving the central question unresolved: when may images and biometric data collected without authorisation remain available?

This issue is reportedly one of the factors delaying the publication of the measure in the Official Gazette. In recent days, the chairman of the Data Protection Authority, Pasquale Stanzione, has drawn a clear line: ‘Facial recognition has significant investigative value if used in a limited manner and with all necessary safeguards. It must not, however, become a tool for mass and indiscriminate surveillance.’