Jamal: 00:00

Hello, and welcome to another episode of the Privacy Pros podcast. I'm your host, Jamal Ahmed, author of the Easy Peasy Guide to the GDPR, your must have guide if you want to become the Go-to GDPR expert. In today's episode, I'm thrilled to share my keynote speech from the Personal Data Future Perspective conference in Latvia, where I spoke about the privacy implications of facial emotion recognition. It was an incredible conference with over 30 inspiring speakers. And a huge thank you to Jekaterina Macuka, a previous guest on the podcast, and the director of the Latvian Supervisory Authority, the Data State Inspectorate, for inviting me to the conference. Without further ado, let's dive into my talk. But first, a quick reminder to subscribe to our podcast and leave a review on your favourite platform. Your feedback is vital in helping us to continue deliver valuable content to you for no charge.

Intro: 00:53

Are you ready to know what you don't know about Privacy Pros? Then you're in the right place.

Intro: 01:00

Welcome to the Privacy Pros Academy podcast by Kazient Privacy Experts. The podcast to launch, progress and excel your career as a privacy pro.

Intro: 01:11

Hear about the latest news and developments in the world of privacy, discover fascinating insights from leading global privacy professionals, and hear real stories and top tips from the people who've been where you want to get to.

Intro: 01:26

We've trained people in over 137 countries and counting.

Intro: 01:30

So whether you're thinking about starting a career in data privacy or you're an experienced professional, this is the podcast for you.

Jamal: 01:47

According to science, there is one feature on your face that is the most important when it comes to expressing your emotions. And when we express emotions, we have 46 muscles on our face that make them up. But this one feature that is the most important. I'd like you to have a think for a moment and guess what that might be. According to a University in Canada, the University of Lethbridge, according to their recent study, it's in fact, your eyebrows that is the most important when it comes to expressing emotional expressions. Now, that brings us onto facial recognition. In fact, what I want to do is make sure that we all leave here today understanding how this disruptive and innovative technology actually works. So I'm going to make that easy peasy. So I'm going to have a look at what is facial recognition? How does it actually work? How is it used? Is it reliable? And are our facial expressions actually universal? What is facial recognition? Facial recognition technology is one of those biometric technologies that helps us to identify individuals by analysing their physiological or behavioural characteristics. And biometrics have been developed to identify people using their fingerprints, using their hands, using their eye, retinas and irises, their voice, their gait, and also their face. So facial recognition is a technology that's used to identify individuals by analysing physiological or behavioural characteristics on their face. And there's three types of facial recognition. The first one is facial verification.

Jamal: 03:25

That's one to one matching. So these systems try to determine whether a face matches a single facial template, often saved on a device. Many phones, your laptops, use this verification technology to allow you to log on to your devices more securely. Facial verification can also be used to facilitate secure entry into buildings, to match against a passport at an e-gate crossing, or to prove someone's identity to access some kind of public service online. The second type is facial identification. This is different to verification because instead of doing one to one, this does one to many. These systems try to determine whether a face matches any facial template in a database of individuals. And these databases can be of any size, sometimes running into millions of images. Facial identification technology was previously used by Facebook, and for those of you who opted into face recognition, your phones were set to automatically recognize any photos or videos and ask you whether you want to be tagged in those. Facebook gave people the option to automatically be notified when they appear in these photos, and they provided recommendations for who to tag in your photos when you uploaded them. Facial identification technology is also used by the police and private security to locate people of interest in a crowd. So, for example, if there's people walking across the street, the camera can pick somebody up. When you combine that with CCTV, scan the crowds, and then match your face against a known database of suspects or people of interest. And the third type of facial recognition is categorisation. This is where you match general characteristics. So facial recognition is used to extract information about an individual's characteristics, which is usually called a face analysis. It's used to profile individuals, which involves characterising them based on a specific personal characteristic.

Jamal: 05:25

And these characteristics commonly predict from their facial images, their sex, their age, and even their ethnic origin. Categorisation means that the technology is used to extract the characteristics of the individuals which do not necessarily allow for identification. However, if several characteristics can be inferred from a phrase and potentially linked to other data, for example, location data, then it could enable the identification of an individual. Facial recognition technology can also be used to infer emotions such as anger, fear, or happiness, and also detect whether you're lying or telling the truth. So how does it actually work? There's four basic components to facial recognition technology. Number one is you need a camera to capture the image. Then you need an algorithm to create a face print, sometimes called a facial template. You then need a database of stored images, and finally, you need an algorithm to compare the captured image to the database of images on a single image on the database. And there's four stages to this process. Step number one is the development. Now, most facial recognition software has two key functions. Number one, to identify the presence of a human face in an image and number two, to map their key features within that face, which allows the comparison to be made. So for example, if you were to think about your face for a moment to be able to map your face to a database of other images, what they would do is create a facial template of that and they would identify about 300 different points on your face and try and see how that differs from everyone else. And it should find that there is a unique pattern. So the things it will pick up on is how deep are your eye sockets?

Jamal: 07:20

What is the distance from one eyebrow to another eyebrow? What is the distance between one pupil to another pupil? How deep are your lips? How much do they stick out? What is the distance from the bottom of your lip to the bottom of your chin? There's about 300 different data points that they can identify to help them get this a little bit more correct. And this includes defined rules, so patterns of light and dark around a person's eyes or nose and from training on a large number of other facial images. So the first stage is we need to develop the software and we need to train the software so that it can actually make some kind of predictions. And then a finished facial recognition technology system can recognize similarities between faces even if they are viewed in different conditions. But training facial recognition technology algorithms can sometimes require millions of labelled images and a lot of calculation time. And therefore what you'll find is that most organizations actually don't bother with the development, they will actually go to a readymade solution. Rely on software as a service using trained facial recognition technology that will have a pretrained algorithm that is sufficient for them to be able to do the task. The second stage is deployment. Once you've developed your facial recognition technology or once you found a solution, you can deploy it in real world setting to verify or identify individuals as they feature in any new image data, either in the form of digital photos or even video footage.

Jamal: 08:50

And that can also be live or it could be recorded once deployed. Your facial recognition technology process involves detecting a face when it's present and then cropping this segment of the image to remove as much background noise as possible to improve the accuracy of the picture. Then the facial recognition technology software will analyse the face, create an array of numbers, also known as the template, that represents its features and their position in relation to one another. With facial verification, the finished template is then compared with the template that's generated from another facial image which is often stored on your phone or your device or some instances if you have a biometric passport, it will reside onto the chip on that for identification. That template is then compared with all the templates in the database to find the closest matches. The third stage is the result. This is where the system will present its result to you. And given that no facial recognition technology is completely accurate, it's actually up to the organisation that's deploying the software to determine an acceptable similarity threshold, the lowest score that is counted as a positive match. So sometimes they might get false positives. Wrong identifications can be tolerated, but the threshold can be set relatively low to allow for this. And this is the case people suggested for tags in Facebook photos. If, however, the stakes are high, similarity thresholds should be set at the upper end of the scale.

Jamal: 10:23

And this is the case when facial recognition technology is used to give secure access to somebody's bank account. And the final stage of the process is the execution. Except where you have a fully automated facial recognition software system, for example, those that are used to unlock a mobile phone, any matches made by the software will be passed on to the human operator and that human operator can then make the final decision on whether to act on the result or not. So, for example, if you have a security guard who is monitoring the systems and a known shoplifter walks in, it will be alerted to them that this person is known as a shoplifter. They match potentially a shoplifter, and then the security guard has to decide whether they will intervene with that potential shoplifter or not. So that brings us on to the next point. Now we know what facial recognition technology is, we know the four components to it, and we also know the process. How is it actually used? So, first of all, it helps us with access control. From personal electronic devices like your phone, your tablet or your PC, even medical cabinets. It helps us to get into those things. It can help us with physical access to your home, to your office, to industrial facilities, hospitals, schools, anywhere and everywhere. There is a need for restricted access.

Jamal: 11:43

And I know what some of you are thinking, great, it means I don't have to talk to people anymore, I can talk to less people. When you arrive at your appointment, it can actually recognise that you're here and you no longer have to speak to the checkout person. The next step is security and surveillance. So, biometric passports, for example, automated passports control. British Airways uses facial recognition for passengers boarding their flights from the United States. And travellers faces can be scanned by a camera to have their identity verified to board the plane without even having to show their passports or their boarding passes. And the airline has been using technology on UK domestic flights from Heathrow, and it's working towards biometric boarding for all international flights at the airport. Health and safety, patient check in and check out, patient monitoring and diagnosis. Face recognition can be combined with complementary technologies such as real time emotional recognition to get better patient thoughts. For example, it can be used to detect pain, monitor the patient's health status, or even identify symptoms of some illnesses. Face mask scanning is also available to ensure that access is given only if somebody is wearing a mask. In banking, in financial services, and in financial technology, we could actually use facial recognition to have cardless ATM transactions, opening a bank account and opening an investment account, or even applying for an insurance policy. Marketing and advertising. Marketers have used facial recognition to enhance personalized customer experiences.

Jamal: 13:15

used facial recognition for a: 2017

Jamal: 14:43

Facial recognition can also be used to search of video sequences for the child's predicted location at the time of disappearance. And officers will be better able to understand the child's movement before going missing and pinpoint the location where he or she was last seen. And a real time alert can alarm anytime when a match is found. After that, the police can validate its authenticity and take whatever steps are necessary to locate the missing kids. Similarly, it can also be used to track dangerous criminals. Another use for this is time and attendance. So whether it's in the office, whether it's at an industrial facility, whether it's at your hospital or the school, anywhere and everywhere where there is a need for restricted access, facial recognition can actually come in and help us out. When it comes to the automotive industry, it can help recognizing drivers. You no longer have to carry your keys. Your car will automatically unlock as you arrive in front of the door. The technology will replace key to access and start the car and remember drivers preferences for seat and mirror positions and radio station pre-sets. And there's also other uses for this technology. For example, Google incorporates the technology into Google Photos and uses it to sort pictures and automatically tag them based on people that it recognizes.

Jamal: 15:58

chnologies by a study done in: 2019

Jamal: 17:43

a set. So, let's say you have: 1000

Jamal: 19:17

This is where it's computing your recall of your algorithm. You only need to consider the real true label data amongst your data set and then compute the percentage of right precisions. And precision is also a positive predictive value. Now, depending on the objective of you deploying the facial recognition software will depend on what your confidence threshold is. So, for example, if it's wanting to tag you in a photo, you might say anything above 70% is okay. But if it comes to something a little bit more secure, like getting access to your bank account, you might request that it's only 99%. Or if you're looking for a known criminal who is very dangerous, anything above 80% might be worth checking to verify. And anything below that, you might not think about. And that brings us on to the final part. Are facial recognition expressions universal or are there cultural differences? Now, Darwin proposed that facial recognitions of emotion are actually universal, but Dr. Ekman, he disagreed. And Dr. Ekman said that can't be right. What the tests have shown is that the people living in Europe and the North America and the people living in Asia, they've probably just been exposed to the same TV shows, and therefore they use the same emotions. So to prove this theory, he decided he's going to go to a remote island that is completely cut off from civilization, where they've had no TV programs, they're not used to the popular culture, and he's going to see what happens there. So he went all the way to a tribe in Papua New Guinea and he conducted the experiments. And what he actually found was there are six expressions that are universal. These are happiness, fear, sadness, surprise, anger, and disgust.

Jamal: 21:12

ur organisations. In February: 2019

Jamal

And to answer that question, I'd like to use a quote I heard, guns don't kill people, people kill people. So facial recognition technology is neither good nor bad. It's up to you to deploy it in a way that is honest and in a way that is keeping with the freedoms that were guaranteed under the European Convention of Human Rights. The other problem with facial recognition technology is it takes away our anonymity and it significantly decreases that. So, for example, if you have facial recognition technology, like we do in London on all of the CCTV cameras, whenever you go shopping, the authorities are able to identify who you are, where you are, where you've been, how long you've been there, how much time you've spent there, who you've been there with, and who you haven't been there with. And this raises all sorts of problems, especially because people might now start to hesitate where they go shopping, or where they assemble, or how they protest and exercise their freedom of speech. And if you think about Kalo's subjective privacy harms, this can actually be quite distressing for individuals just to think that they might be being watched and not knowing what decisions are being made about them and start questioning their own selves. And also it can lead to lack of transparency. Facial scans can be captured very easily and remotely and in secret, unlike other biometrics. For example, fingerprints. You know you are placing your fingerprint somewhere, your palm print, you know you're facing your hand somewhere, your eye scan, you know you have to look into something.

Jamal: 24:34

With CCTV and facial recognition built in, you might have no idea you're actually being profiled. And if you think about the Clearview AI study, they scraped facial data from the online space and they used it for who knows what purposes. And even though they've been asked to delete that information by the Information Commissioner's, office. We have no idea how many people they've shared it with and where those databases lie. And I'd like to leave you with a quote from George Orwell until they become conscious, they will never rebel, and until after they have rebelled, they cannot become conscious. So let's come back to the beginning. Must emotion recognition always be considered personal data processing? So first we have to define what is personal data? It's any information that's relating to an identifiable or identified natural person. So based on the uses and the types of facial recognition, we know that if it's used for verification or identification, it will definitely be personal data. And processing is defined as any operation performed on personal data. So even when it comes to characterization, because we are making analysis of that, it will come into scope of the GDPR.

Outro: 25:48

If you enjoyed this episode, be sure to subscribe, like and share so you're notified when a new episode is released.

Outro: 25:56

Remember to join the Privacy Pros Academy Facebook group where we answer your questions.

Outro: 26:01

Thank you so much for listening. I hope you're leaving with some great things that will add value on your journey as a world class Privacy Pro.

Outro: 26:09

Please leave us a four or five star review.

Outro: 26:11

And if you'd like to appear on a future episode of our podcast, or have a suggestion for a topic you'd like to hear more about, please send an email to team@kazient.co.uk

Outro: 26:23

Until next time, peace be with you.