The Federal Trade Commission told a Senate Judiciary subcommittee on Wednesday that it is examining the benefits to consumers, as well as privacy and security concerns related to future commercial uses of facial recognition technologies, and will make recommendations later this year on best practices for companies.
The recommendations will build on comments from a recent FTC workshop on facial recognition technology, and on the three core principles from the agency's March 2012 Privacy Report - including privacy by design, simplified consumer choice and transparency.
The FTC testimony by Maneesha Mithal, associate director of the Division of Privacy and Identity Protection, before the Subcommittee on Privacy, Technology and the Law, states that, "While consumers may enjoy the benefits associated with advancements to these technologies . . . there are also concerns that the technologies may increase the risks to consumer privacy."
Facial recognition technologies are used for mobile applications, digital signs and social networks, among many things, the testimony states. They range from pure facial detection, meaning detecting a face in an image, to biometric analysis of facial images, in which unique mathematical data are derived from a face to match it to another face.
According to the testimony, the technologies also can be used to determine the demographic characteristics of a face, such as age range and gender, and to recognize emotions.
"Recognizing that the commercial use of these technologies will likely continue to grow, the FTC has sought to understand how these technologies are being used, how they could be used, and how they will shape consumers' commercial experiences," the testimony states.
The testimony described recent advances in facial recognition technologies, current and possible future commercial uses, and privacy considerations the FTC is examining.
FTC staff will issue a report later this year recommending best practices for using the technologies in a manner that respects consumer privacy. The report will be based on panelist discussions from the FTC's facial recognition technologies workshop held in December 2011.
The report will not serve as a template for law enforcement actions or regulations under laws currently enforced by the FTC, the testimony states.
The FTC also is considering how the three core principles from the agency's March 2012 Privacy Report can be applied to the use of facial recognition technologies:
• Privacy by Design – companies should build in privacy at every stage of product development, including reasonable security for consumer data, collecting only the data that is consistent with the context of a particular transaction or the consumer's relationship with the business, retaining data only as long as necessary to fulfill the purpose for which it was collected, safely disposing of data no longer being used, and implementing reasonable procedures to promote data accuracy;
• Simplified Consumer Choice – for practices that are not consistent with the context of a transaction or a consumer's relationship with a business, companies should provide consumers with choices at a relevant time and context, and should obtain affirmative consent before collecting sensitive data or using consumer data in a materially different manner than claimed when the data was collected; and
• Greater Transparency – companies should increase the transparency of their data practices so that interested parties can compare data practices and choices across companies, and companies – particularly those that do not interact directly with consumers, such as data brokers – should provide consumers with reasonable access to the data that the companies maintain about them.