Supermarket is not allowed to use facial recognition software

Faces in images are biometric personal data, and processing them is prohibited in principle. A supermarket that used facial recognition to identify shoplifters received a warning from the Dutch Data Protection Authority: the importance of combating shoplifting does not outweigh the statutory security exception, and merely entering the store does not count as valid consent.

The Dutch Data Protection Authority (AP) issued an official warning to a supermarket after it installed facial recognition software. In a previous blog, we already discussed the pitfalls of biometric authentication in the workplace; this case shows that such software is a sensitive issue outside of that context as well.

Why is biometric data so strictly protected?

Images or photographs of faces intended to identify an individual are biometric data — a special category of personal data. Processing such data is prohibited in principle, unless the GDPR provides for an exception. Two exceptions are relevant here:

• Explicit consent of the data subject. That consent must be freely given: a person can freely choose to secure their phone with a fingerprint because a PIN code is also an option.
• Security or authentication purposes necessary for an overriding public interest.

What had the supermarket done?

The supermarket did not rely on visitor consent, but on the security exception. Using the software, the store could check whether people with a store ban—for example, due to previous theft or threatening staff—were entering. Images of visitors without a store ban were immediately deleted, and visitors were informed about the processing. Goal: to prevent shoplifting and protect staff and visitors.

Why did the Dutch Data Protection Authority intervene?

According to the AP, facial recognition is too heavy-handed a measure to combat shoplifting. The security exception requires a compelling interest: examples include customs checks at an airport or the security of nuclear power plants and military installations — not the prevention of shoplifting.

Because the supermarket could not invoke the security exception, it came down to consent. Visitors were informed, but were not required to give consent. According to the AP, the mere fact that someone enters the store while aware of the processing does not count as valid consent. Consequently, a valid legal basis was lacking, and a warning followed.

What does this mean for your business?

The Dutch Data Protection Authority (AP) has long taken the incorrect processing of biometric data very seriously, while more and more tools are entering the market that use this data — think of time tracking via facial recognition. This often relies on consent. A self-employed professional can freely give consent for themselves, but regarding employees, it is questionable whether consent is truly free, given the hierarchical relationship. If you intend to process biometric data — whether based on consent or for a security purpose — seek legal advice beforehand.

Frequently Asked Questions

Am I allowed to use facial recognition against shoplifting?

As a rule, no. According to the AP, combating shoplifting does not carry enough weight for the statutory security exception, and entering the store is not valid consent.

Is staff consent for biometrics valid?

Often questionable. Due to the hierarchical relationship between employer and employee, consent is rarely fully unrestricted, meaning it usually does not provide a solid legal basis.

When is biometrics allowed?

For example, in the case of free, explicit consent, or authentication/security that is necessary for a compelling public interest. Have it assessed on a case-by-case basis whether the conditions are met.

Processing biometric data? Have it reviewed

The processing of biometric data requires precision, and an incorrect assessment can lead to enforcement by the Dutch Data Protection Authority (AP). The privacy experts at MKB Juristen assess whether your processing is permitted and how you substantiate it. View our expertise in privacy and data protection or schedule a free intake consultation .