Numerous privacy and civil rights advocates have expressed concern about the potential misuse of facial recognition technology, including unauthorized surveillance, biased algorithms, and invasions of individuals’ privacy rights. In response to these concerns, a number of organizations and researchers have proposed regulatory frameworks and guidelines for facial recognition technology.
A new report from the Human Technology Institute at the University of Technology Sydney (UTS) outlines a model law for facial recognition technology to protect against harmful use while also encouraging innovation for public benefit.
The law in Australia was not written with the widespread use of facial recognition in mind. The report, led by UTS Industry Professors Edward Santow and Nicholas Davis, suggests reforms to modernize Australian law, particularly to address threats to privacy and other human rights.
In recent years, facial recognition and other remote biometric technologies have grown exponentially, raising concerns about privacy, mass surveillance, and unfairness experienced, particularly by people of color and women, when the technology makes mistakes.
The purpose of this report is to propose a risk-based model law for facial recognition. The starting point should be to ensure that facial recognition technology is developed and used in ways that protect people’s fundamental human rights.
Professor Santow
An investigation by consumer advocacy group CHOICE in June 2022 revealed that several large Australian retailers were using facial recognition to identify customers entering their stores, causing widespread community outrage and calls for tighter regulation. There have also been widespread calls for facial recognition law reform in Australia and around the world.
This new report is in response to those requests. It acknowledges that our faces are unique in that humans rely heavily on each other’s faces to identify and interact. When this technology is misused or overused, we are especially vulnerable to human rights violations.
“When facial recognition applications are designed and regulated well, there can be real benefits, helping to identify people efficiently and at scale. The technology is widely used by people who are blind or have a vision impairment, making the world more accessible for those groups,” said Professor Santow, the former Australian Human Rights Commissioner and now Co-Director of the Human Technology Institute.
“The purpose of this report is to propose a risk-based model law for facial recognition. The starting point should be to ensure that facial recognition technology is developed and used in ways that protect people’s fundamental human rights,” he said.
“Gaps in our current law have resulted in a type of regulatory market failure.” Many well-known companies have backed away from offering facial recognition because consumers are not adequately protected. “Those companies that are still providing services in this area are not required to focus on the basic rights of people affected by this technology,” said Professor Davis, a former member of the executive committee at the World Economic Forum in Geneva and Co-Director of the Human Technology Institute.
“Many civil society organizations, government and inter-governmental bodies, and independent experts have sounded the alarm about dangers associated with current and predicted uses of facial recognition,” he said.
This report calls on Australian Attorney-General Mark Dreyfus to lead a national facial recognition reform process. This should start by introducing a bill into the Australian Parliament based on the model law set out in the report.
The report also suggests that the Office of the Australian Information Commissioner be given regulatory responsibility for regulating the development and use of this technology in federal jurisdiction, with a harmonized approach in state and territory jurisdictions.
The model law establishes three levels of human rights risk for individuals affected by the use of a specific facial recognition technology application, as well as risks to the broader community.
Anyone who develops or deploys facial recognition technology must first assess the level of human rights risk that would apply to their application, according to the model law. Members of the public and the regulator can then challenge that assessment. Based on the risk assessment, the model law then sets out a cumulative set of legal requirements, restrictions, and prohibitions.
