Criminal Charges Mount Against Facial Recognition Giant: Why AI Compliance Can No Longer Be Ignored

Separate the headline from verified facts

Allegations, regulatory findings and criminal convictions are different things and should never be treated as interchangeable. Readers should consult authoritative court or regulator sources for the facts and current status of any particular case.

For Irish organisations, the practical question is whether a proposed facial recognition use has a defensible purpose, lawful data processing and appropriate safeguards. Facial recognition is not universally unlawful. Equally, a supplier’s claim that its technology is commercially available does not establish that a customer may lawfully use it.

Understand when facial data becomes biometric data

GDPR Article 4(14) defines biometric data by reference to specific technical processing of physical, physiological or behavioural characteristics that allows or confirms unique identification. A photograph is not automatically special-category biometric data simply because it contains a face. Creating and comparing facial templates for identification presents a different legal question from merely storing an ordinary photograph.

Article 9 generally prohibits processing biometric data for the purpose of uniquely identifying a person unless an applicable exception is established. An organisation also needs an Article 6 lawful basis. Legitimate interests alone does not overcome Article 9. Explicit consent is one possible exception, but it must meet GDPR requirements.

Read the AI Act prohibitions precisely

Article 5 prohibits creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage. It also prohibits specified biometric categorisation practices that infer listed sensitive characteristics, subject to defined scope and exceptions. These are targeted restrictions, not a blanket prohibition on every facial recognition application.

The Act separately restricts real-time remote biometric identification in publicly accessible spaces for law enforcement. Narrow exceptions concern specified victim searches, certain serious threats and identification or location of suspects for listed serious offences. Necessity, proportionality, authorisation requirements and national-law conditions matter.

The Act also prohibits emotion inference in workplaces and educational institutions, except for systems intended for medical or safety reasons. Biometric verification, remote identification and emotion recognition should not be collapsed into one category.

Ask for evidence before procurement

Document the intended purpose and consider whether a less intrusive method would work. Establish where reference images originate, whether their collection was lawful and who can access templates. Examine retention, deletion, international transfers, security and the supplier’s ability to support individual rights. Where required, complete a DPIA before processing begins.

Test false matches and missed matches under realistic conditions. Evaluate how lighting, camera position and the population using the service affect performance. Decide what staff must do when the system fails. A match should not become an unquestioned accusation, and a failure to match should have a safe, workable alternative.

Make accountability operational

Assign responsibility for legal review, technical testing and day-to-day operation. Contracts should address permitted uses, subprocessors, incident handling, deletion and material changes. Keep enough documentation to explain why the chosen safeguards were considered adequate.

Review the arrangement when its purpose, scale or technical operation changes. Seek specialist advice where necessary, particularly for workplace monitoring or identification at scale.