Feeds

FTC issues guidelines on facial recognition technology

Watching them, watching you

Protecting against web application threats using SSL

The Federal Trade Commission has issued a staff report on best practices for companies using facial recognition technology in their businesses.

"Fortunately, the commercial use of facial recognition technologies is still young," the report states. "This creates a unique opportunity to ensure that as this industry grows, it does so in a way that respects the privacy interests of consumers while preserving the beneficial uses the technology has to offer.”

The report recommends that developers should approach such systems with "privacy in mind" – which sounds nice, but most of them are still concentrating on getting the technology to work as advertised in the first place, at least in El Reg's experience.

Companies need to set up appropriate security systems to safeguard facial identifying information, such as the distance between the eyes or length of the face, the report suggests. Once a customer stops using a facial service, that data needs to be wiped to safeguard privacy going forward.

Care should also be taken in considering where such systems are used. The FTC gives the example of digital signage that uses software to determine the age and sex of the viewer, and suggests leaving them out of places like locker rooms or toilets to avoid worrying people. Such signs should also be clearly marked, presumably so that they can be avoided.

Social networks come in for more-specific recommendations. Any kind of facial recognition system needs to be clearly signposted, and users need an easy way to opt out of any systems should they so desire. If they do choose to use such systems, they should have the right to not only opt out at a later date, but also to have all prior biometric data deleted.

The FTC also warns of a couple of issues that companies really need to deal with. First, express permission should be sought if the facial images are going to be used for anything other than the specific purpose they are gathered for, and nothing "materially different."

Second, applications shouldn't be developed that allow the identification of people without their express consent. The report suggests this could head off stalker apps that would allow someone to be surreptitiously photographed, identified, and then chatted up using information available online.

The report is at pains to point out that the report shouldn't be seen as a guide to forthcoming legislation, but instead merely to provide guidance for companies getting involved in the nascent field. It appears we'll have to wait until someone actually sues before there are any statutory controls.

"To the extent the recommended best practices go beyond existing legal requirements, they are not intended to serve as a template for law enforcement actions or regulations under laws currently enforced by the FTC," it reads.

"If companies consider the issues of privacy by design, meaningful choice, and transparency at this early stage, it will help ensure that this industry develops in a way that encourages companies to offer innovative new benefits to consumers and respect their privacy interests."

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.