The 2019 Maltese budget, put forward the proposal of installing facial recognition CCTV cameras in various localities with the purpose to increase the security.
Is Facial Recognition a proportionate response?
The EU Directive 2016/680 deals specifically with the protection of persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties and on the free movement of such data. This Directive in itself does not;
“prevent the law-enforcement authorities from carrying out activities such as covert investigations or video surveillance. Such activities can be done for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, as long as they are laid down by law and constitute a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the natural person concerned.”
The proposal of the 2019 Budget specified that the use of such system will be in the areas of Paceville and Marsa, whereby according to the Malta Crime Report 2016, St Julian’s area continued to register the highest crime rate, at five times the national average. Therefore, one should analyse whether the crime rate around such areas warrants the use of CCTV to make them safer zones and if these are necessary for justice to be ensured. In addition, one should also keep in mind that this system should not be prejudicial to the rights of natural persons to an effective remedy and the right to undergo fair trial.
The setting up of any surveillance brings about a myriad of legal implications as there is a thin line between the right to public security and the right to privacy. Prof Cannataci, the United Nations special rapporteur on privacy, made a statement on a local newspaper, that for facial recognition capacity to be installed one needs to have a strong justification – such as a risk of a terror attack or serious crimes. The notion of serious crimes was not specified, but the idea of proportionality was highly emphasized upon. In fact, Prof Cannataci stated that;
“The occasional brawl spilling out onto the street or even stabbing may justify the limited use of some CCTV in public spaces, but not the type which is equipped with facial recognition. It must also be linked to other measures taken by the police intended to secure timely response to a specific type of incident,”
What are the legal implications for an outside company to provide advanced video surveillance?
The Directive 2016/680 caters for this particular instance, as it gives a broader definition to ‘competent authorities’;
“Such competent authorities may include not only public authorities such as the judicial authorities, the police or other law-enforcement authorities but also any other body or entity entrusted by Member State law to exercise public authority and public powers for the purposes of this Directive.”
Nonetheless, this body or entity is also bound to respect the regulations of this Directive, whilst also have a specific contract or other legal act to ensure that there is proper regulation in the processing of personal data. In fact, before this technology is put into practice there needs to be proper regulation and action to make sure that the general public is made aware of the risks, rules, safeguards and rights in relation to the processing of their personal data and in case of suspected infringement, the people need to know how to exercise their rights in relation to the processing. In particular, the purpose for which the personal data is processed should be explicit, legitimate and determined at the time of the collection of the personal data.
That laws need to be enacted in this area goes without saying, moreso as this is a new area of technical development dealing exclusively with very personal data, its collection and analysis to an unprecedented level. The use of personal data in light of the legitimacy thereof is the control area which has to be scrutinized and needs to be overseen as the higher the degree of personal data acquired the higher the degree of possible abuse. So, whether we have simply surveillance or Facial Recognition capable cameras and systems, the crux is in the enabling use thereof and the safeguards for ordinary citizens from any abuse of such systems.
This shall not be construed to be as advice but shall merely serve as a brief description. If you would like to get to know more about this please do not hesitate to contact us on [email protected].