I was refused entry in a local B&M store today

Alderbank

PragmaticMoneySaver said:

Their use and storage etc is deemed as lawful as in the excerpt elsein posted; however the one thing I personally think they are on shaky ground with is the way they are using the systems without human decision making.  The Data Protection Act (incorporating GDPR) provides for an individual to object to solely automated decisions, including those based on profiling, must not have a significant impact on individuals without proper safeguards. 

The way they are saying it 'flagged' indicates entirely automated decision making to me.

It would be automated if without human intervention the system automatically flashed up the OP's mugshot on all the store's security screens with the warning 'KNOWN OFFENDER - WATCH YOUR PURSE' or something similar.

However the system seems to have discreetly alerted the security guard who has made the human decision to have a word with the OP and deny them entry.

According to their website, Facewatch 'matches faces against known offenders as they enter your premises and sends an alert instantly.'

'Known offenders' is not defined there but from what the security guard told you it includes anyone who has been argumentative or 'a nuisance' in any branch of any subscriber's store throughout the UK.

As the subscribers include Frasers Group stores like Sports Direct, the database of customers they consider 'a nuisance' is probably quite large.

PragmaticMoneySaver

But from the OP the security guard pretty much responded with "Computer says no"

Alderbank

To be fair, we don't know how many 'known offenders' he allowed to enter or the basis of his human decision to stop the OP.

DullGreyGuy

Alderbank said:

PragmaticMoneySaver said:

Their use and storage etc is deemed as lawful as in the excerpt elsein posted; however the one thing I personally think they are on shaky ground with is the way they are using the systems without human decision making.  The Data Protection Act (incorporating GDPR) provides for an individual to object to solely automated decisions, including those based on profiling, must not have a significant impact on individuals without proper safeguards. 

The way they are saying it 'flagged' indicates entirely automated decision making to me.

It would be automated if without human intervention the system automatically flashed up the OP's mugshot on all the store's security screens with the warning 'KNOWN OFFENDER - WATCH YOUR PURSE' or something similar.

However the system seems to have discreetly alerted the security guard who has made the human decision to have a word with the OP and deny them entry.

Thats the bit that isnt immediately clear... has the system shown them both the mugshot of the OP and the mugshot of the "known offender" and they have made the decision they are one and the same person or is the security guard simply told to deny entry to the customer without seeing images? 


At the end of the day a shop is private property and they are free to deny entry to anyone they want for any reason as long as its not based on protected characteristics, the old "no blacks, Irish or dogs allowed" signs are not permissible. 

There may be a separate GDPR question on if the provider of the system is fully compliant, for that you'd need to look at the signage and read their privacy policy. The above point becomes relevant because of the 8th right under GDPR on automatic decision making. 

born_again

Go back again & see if they decline entry. Ten ask to see picture they are basing decision on. If they will show you it. 
Which giving they are saying it is you, then you should have a right to view it. 

eskbanker

HopeAndDriftWood said:

PragmaticMoneySaver said:

Their use and storage etc is deemed as lawful as in the excerpt elsein posted; however the one thing I personally think they are on shaky ground with is the way they are using the systems without human decision making.  The Data Protection Act (incorporating GDPR) provides for an individual to object to solely automated decisions, including those based on profiling, must not have a significant impact on individuals without proper safeguards. 

The way they are saying it 'flagged' indicates entirely automated decision making to me.

Is the human element not the security guard "deciding" to refuse access?

That's certainly their contention:

Rights in relation to automated decision making and profiling – this right is not applicable in our processing activity due to the meaningful human involvement in decision making during our processing.

https://www.facewatch.co.uk/privacy/

nero33

Basically when I tried to go in, this time with the security guard present, his mobile buzzed very loudly. He didn't view any images from anywhere. There's a camera as you walk in pointing at the entrance and an LCD screen next to it.

My relative is going to go back and see if its possible to speak to the manager but the store is full of very young staff and supervisors all look like they're forced to be there so I doubt we'll get any joy from them.

Can someone tell who I need to contact for the SAR? B&M or FaceWatch? Thanks

A_Geordie

Facewatch, along with Home Bargains are being sued by a teenager who was mistakenly identified as a shoplifter. Facewatch have already admitted mistaken identity (despite their wild claims of at least 99% accuracy before an alert is sent) and the OP may want to sit it out and wait the outcome of that case if considering the legal route. Big Brother Watch is bringing the claim on the teenager's behalf. 

This isn't and won't be the last time it happens but will be interesting to see how it plays out in court. The EU is already looking to curb the use of live facial recognition tools through the proposed AI Act and I understand some US states have prohibited its use due to the number of mistaken identification issues which has led to wrongful arrest claims. 

PragmaticMoneySaver

nero33 said:

Basically when I tried to go in, this time with the security guard present, his mobile buzzed very loudly. He didn't view any images from anywhere.

And despite their protestations that automated decision making isn't used that explanation is exactly what IS being used.

mikb

nero33 said:

Can someone tell who I need to contact for the SAR? B&M or FaceWatch? Thanks

Facewatch. It's right there at the bottom left of the poster you photographed -- "Our data protection officer..../Facewatch is the data controller" part showing email/phone numbers.