The Information Commissioner's Office ('ICO') issued, on 31 March 2023, a blog post, in which it stated that it had completed its investigation of the security company, Facewatch Limited, which provides live facial recognition technology ('FRT') systems to the retail sector. In particular, the ICO highlighted that while it considered that Facewatch's product complies with data protection legislation, relying on legitimate interests in processing people's personal data, it had also found areas of concern for Facewatch to address, which include:

• reducing the personal data it collects by focusing on repeat offenders or individuals committing significant offences;
• improving its procedures by appointing a data protection officer ('DPO'); and
• protecting data subjects classified as vulnerable by ensuring they do not become a 'subject of interest'.

In this regard, the ICO noted that Facewatch has made and continues to make improvements to its product based on the ICO's concerns, and as such stated that no further regulatory action is required.

Notably, the ICO highlighted that the closure of its investigation of Facewatch does not give organisations a green light to the blanket use of FRT and that each new application of such technology must be considered on its own merits, balancing individuals' privacy rights with the benefits of preventing crime.

You can read the press release here.