Facebook must destroy facial recognition data - or get users' approval, Germany decides
The German data protection authority has decided to reopen its inquiry into Facebook's facial recognition tech.
The inquiry, set up by the Hamburg data protection agency, centres on Facebook's Photo Tag Suggest feature, which analyses photos uploaded to the social networking site and automatically matches faces to the sites members using facial recognition software.
The probe was initially suspended in June after Facebook told the agency it was close to a breakthrough in its talks with the Irish Data Protection Agency – the Irish watchdog had been carrying out a privacy audit of the company - and the German authority decided to suspend proceedings in favour of negotiating an agreement with the company.
The Hamburg commissioner for data protection and freedom of information, Professor Dr Johannes Caspar, has now reopened the inquiry after Facebook told the agency that it was unwilling to make any concessions beyond agreeing to stop collecting new facial profiles.
The agency's main concern is that Facebook does not notify its users that the facial recognition technology is being used, and claims that a biometrics database containing millions of faces has "immense potential" for being misused.
"This data has been collected without the necessary users’ consent rendering the resumption of the [agency's] proceedings against Facebook inevitable," it said.
Caspar wants Facebook to delete all the data already gathered, or at least ensure that the users actively consent to their data being used in this way.
"Facebook seems to recognise that its current procedure to collect biometric data of its users conflicts with European and German data protection laws. This development is to be welcomed. Yet, Facebook is not entitled to stop their commitment halfway," he said.
"It is regrettable that Facebook has not used the chance for a consensual solution but is obviously playing for time. However, we will now resume administrative proceedings. Facebook has detailed knowledge of our legal opinion. They are welcome to inform us about an acceptable method obtaining consent by the concerned users or to confirm the deletion of the collected facial data at any time," Caspar added.
Facebook argues it is in ongoing talks with the Office of the Irish Data Protection Commissioner and had agreed to develop a best practice solution to notify people on Facebook about Photo Tag Suggest. However the Irish Data Protection Commissioner seems far less optimistic about the matter than Facebook may hope and is currently completing its second audit.