FTC: rapport sur la reconnaissance faciale

La Federal Trade Commission (FTC) vient de publier son rapport sur la reconnaissance faciale: "Facing Facts: Best Practices for Common Uses of Facial Recognition Technologies". 

Ce rapport revient sur les travaux menés par la FTC depuis décembre 2011, notamment le Face Facts workshop qui a conduit à un examen des progrès et des utilisations actuelles et futures de cette technologie au regard de la protection des renseignements personnels (billet). Et, il présente les trois scénarii suivants: 

1. Facial Detection: "An eyeglass company allows consumers to upload their images to the company’s website and then uses facial detection to detect the face and eyes in the image and superimpose various styles of glasses on the consumer’s face. The company stores the images in order to enable consumers to use this feature of the website in the future without uploading a new image". (Source: FTC report, p. 11-12)
2. Detection or Recognition of Demographic Characteristics in Digital Signs: "A sports drink company operates digital signs in a supermarket. These signs include cameras and have the ability to assess the age range and gender of the consumer standing in front of them. The signs display a targeted advertisement to the consumer based on those demographic characteristics. The consumer’s image is processed instantaneously while the consumer is standing in front of the sign and is not stored for future use".(Source: FTC report, p. 13-17)
3. Facial Recognition in Online Social Networks: "An existing social network implements a facial recognition feature. When a user uploads new photos, the social network scans those photos against existing “tagged” photos of the user’s “friends.” The social network then identifies the user’s “friends” in the new photos so the user can tag them. Users cannot utilize the feature to identify other users who are not their “friends."". (Source: FTC report, p. 17-20)

Partant, et en gardant à l'esprit les principes de protection intégrée de la vie privée (Privacy by Design - PbD), de politique de confidentialité simplifiée et de transparence mis de l'avant en mars 2012 dans "Protecting Consumer Privacy in an Era of Rapid Change" (billet), le présent rapport du FTC contient les recommandations suivantes : 

"The FTC staff report recommends that companies using facial recognition technologies:
- design their services with consumer privacy in mind;
- develop reasonable security protections for the information they collect, and sound methods for determining when to keep information and when to dispose of it;
- consider the sensitivity of information when developing their facial recognition products and services – for example, digital signs using facial recognition technologies should not be set up in places where children congregate.
The staff report also recommends that companies take steps to make sure consumers are aware of facial recognition technologies when they come in contact with them, and that they have a choice as to whether data about them is collected.  So, for example, if a company is using digital signs to determine the demographic features of passersby, such as age or gender, they should provide clear notice to consumers that the technology is in use before consumers come into contact with the signs.
In another example cited in the report, FTC staff recommends that social networks using facial recognition features should provide consumers with clear notice about how the feature works, what data it collects, and how that data will be used. They also should provide consumers with an easy to use choice not to have their biometric data collected and used for facial recognition, and the ability to turn the feature off at any time and have the biometric data previously collected from their photos permanently deleted.
Finally, the report states, there are at least two scenarios in which companies should get consumers’ affirmative consent before collecting or using biometric data from facial images. First, they should obtain consent before using consumers’ images or any biometric data in a different way than they represented when they collected the data.  Second, companies should not use facial recognition to identify anonymous images of a consumer to someone who could not otherwise identify him or her, without obtaining the consumer’s affirmative consent first."

(Source: FTC, Press Release)

Pour aller plus loin, 

• FEDERAL TRADE COMMISSION, Facing Facts: Best Practices for Common Uses of Facial Recognition Technologies, October 2012. 
• FEDERAL TRADE COMMISSION, "FTC Recommends Best Practices for Companies That Use Facial Recognition Technologies", Press Release, October 22, 2012.