Feeds

FTC issues guidelines on facial recognition technology

Watching them, watching you

SANS - Survey on application security programs

The Federal Trade Commission has issued a staff report on best practices for companies using facial recognition technology in their businesses.

"Fortunately, the commercial use of facial recognition technologies is still young," the report states. "This creates a unique opportunity to ensure that as this industry grows, it does so in a way that respects the privacy interests of consumers while preserving the beneficial uses the technology has to offer.”

The report recommends that developers should approach such systems with "privacy in mind" – which sounds nice, but most of them are still concentrating on getting the technology to work as advertised in the first place, at least in El Reg's experience.

Companies need to set up appropriate security systems to safeguard facial identifying information, such as the distance between the eyes or length of the face, the report suggests. Once a customer stops using a facial service, that data needs to be wiped to safeguard privacy going forward.

Care should also be taken in considering where such systems are used. The FTC gives the example of digital signage that uses software to determine the age and sex of the viewer, and suggests leaving them out of places like locker rooms or toilets to avoid worrying people. Such signs should also be clearly marked, presumably so that they can be avoided.

Social networks come in for more-specific recommendations. Any kind of facial recognition system needs to be clearly signposted, and users need an easy way to opt out of any systems should they so desire. If they do choose to use such systems, they should have the right to not only opt out at a later date, but also to have all prior biometric data deleted.

The FTC also warns of a couple of issues that companies really need to deal with. First, express permission should be sought if the facial images are going to be used for anything other than the specific purpose they are gathered for, and nothing "materially different."

Second, applications shouldn't be developed that allow the identification of people without their express consent. The report suggests this could head off stalker apps that would allow someone to be surreptitiously photographed, identified, and then chatted up using information available online.

The report is at pains to point out that the report shouldn't be seen as a guide to forthcoming legislation, but instead merely to provide guidance for companies getting involved in the nascent field. It appears we'll have to wait until someone actually sues before there are any statutory controls.

"To the extent the recommended best practices go beyond existing legal requirements, they are not intended to serve as a template for law enforcement actions or regulations under laws currently enforced by the FTC," it reads.

"If companies consider the issues of privacy by design, meaningful choice, and transparency at this early stage, it will help ensure that this industry develops in a way that encourages companies to offer innovative new benefits to consumers and respect their privacy interests."

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.