Abstract:Between May 2017 and April 2019, the South Wales Police in the UK operated the system called “AFR Location” equipped with automated facial recognition technology (henceforth, AFR) for the purpose of finding criminals and missing persons in need of protection. The system is deployed CCTV cameras on police vehicles and analyzes the faces of members of the public are taken from the CCTV feeds and compares them with the faces of the Watchlist to check whether they are the same person. These systems were temporarily used at large public events, such as the Defence Exhibition, and had safeguards to control the risk of data processing, such as software management to delete data such as facial images and biometric data immediately or within 24 hours. However, a civil liberties campaigner filed a lawsuit in October 2018 to challenge the lawfulness of the South Wales Police’s use of AFR, stating the use of AFR violates his right of privacy. This was reportedly the first case to deal with the lawfulness of facial recognition technology by police in the worlds. The Divisional Court dismissed the Claimant’s claim for judicial review on all grounds and ruled in favor of the South Wales Police, but the Court of Appeal affirmed the unlawfulness of the South Wales Police’s use of AFR. The main reason for the unlawfulness is the breach of the requirements of Article 8 of the European Convention on Human Rights. Article 8(1) stipulates “the right to respect private life”, and Article 8(2) provides that such rights shall be no interference by a public authority except such as is “in accordance with the law” and is necessary in a democratic society. According to this, Court of Appeal concluded that there is not a sufficient legal frameworks to properly control the use of AFR by the South Wales Police. There are not enough legal safeguards to properly control the use of AFR system, because there are not any criteria for determining where AFR can be deployed and who can be placed on the watchlist. This judgment of the Court of Appeal has great implications for us. In light of the fact that Article 8(2) of the European Convention on Human Rights is similar to Article 37(2) of the Constitution of Republic of Korea, it provides implications for how the principle of rule of law should be interpreted in relation to the processing of personal and sensitive information processed by biometrics. In other words, whether or not the principle of rule of law has been uphold should be evaluated as whether there are sufficient safeguards to prevent the actual risk of abuse and arbitrary use, not just whether there is a legal basis of processing of data in the Missing Children Act, Act on the Performance of Duties by Police Officer, and the Personal Information Protection Act. In this dimension, this study attempted to suggest proposals of these Acts.

Study on the Protection of the Right to Self-Determination of Personal Information with the Development of Facial Recognition Technology

Study on Compliance of Personal Biometric Information Processing Protocols in Financial APPs

Legal protection of a citizen’s right to a facial image when applying facial recognition technology in Chinese law

Research on Institutional Improvement for Personal Information Collection and Use in the public sector: Use of Video Information collected by Public area CCTV

Protection Profile of Personal Information Security System: Designing a Secure Personal Information Security System

Constitutional implications of judicial review on the use of facial recognition technology by the police in UK

Regulating Facial Processing Technologies: Tensions Between Legal and Technical Considerations in the Application of Illinois BIPA

Assessing Legal Protection of Biometric Data in China: Gaps, Principles, and Policy Recommendations

Facial recognition technology: regulations, rights and the rule of law

The ethical application of biometric facial recognition technology

Automated decision-making in South Korea: a critical review of the revised Personal Information Protection Act

A Study on Privacy Information Protection of Medical Big Data in China

Identifying personal physiological data risks to the Internet of Everything: the case of facial data breach risks

Improvement Issues of Personal Information Protection Laws through Meta-Analysis

De-Identification Mechanism of User Data in Video Systems According to Risk Level for Preventing Leakage of Personal Healthcare Information

Face recognition technologies: regulation problems in Ukraine

Facial Recognition: A cross-national Survey on Public Acceptance, Privacy, and Discrimination

(Do not) remember my face: uses of facial recognition technology in light of the general data protection regulation

A Study of Civil Liability Arising from Defects in AI IoT Systems in MDU(multidwelling unit): Focusing on Personal Information Protection in the case of Intercom System Hacking Incident

Artificial iintelligence facial recognition surveillance and the breach of privacy rights: The ‘Clearview AI’ and ‘Rite Aid’ case studies

Responsible Facial Recognition and Beyond