I was refused entry in a local B&M store today

nero33

mikb said:

nero33 said:

Can someone tell who I need to contact for the SAR? B&M or FaceWatch? Thanks

Facewatch. It's right there at the bottom left of the poster you photographed -- "Our data protection officer..../Facewatch is the data controller" part showing email/phone numbers.

That doesn't mention SAR etc so I don't really know whether that means they'll supply it or B&M.

nero33

A_Geordie said:

Facewatch, along with Home Bargains are being sued by a teenager who was mistakenly identified as a shoplifter. Facewatch have already admitted mistaken identity (despite their wild claims of at least 99% accuracy before an alert is sent) and the OP may want to sit it out and wait the outcome of that case if considering the legal route. Big Brother Watch is bringing the claim on the teenager's behalf. 

This isn't and won't be the last time it happens but will be interesting to see how it plays out in court. The EU is already looking to curb the use of live facial recognition tools through the proposed AI Act and I understand some US states have prohibited its use due to the number of mistaken identification issues which has led to wrongful arrest claims. 

Not interested in legal action but would like to see their evidence and ideally be removed from their most wanted list

A_Geordie

nero33 said:

Not interested in legal action but would like to see their evidence and ideally be removed from their most wanted list

In that case you should write to Facewatch and exercise your data subject rights to make a subject access request together with a erasure request. I should point out that whilst Facewatch are considering themselves as a data controller, it would also appear that B&M would also be considered a data controller in their own right.

Based on the description on the Facewatch website, they take the CCTV images from the retailer and run it through their database then returning a potential match for the retailer to make a decision. The sensible solution would be to write to both companies and ask them to provide everything they hold about you, including any images that have been stored and see what comes up. 

I suspect Facewatch will have more than B&M but if you get nowhere with either company, then your only route may end up being legal action. If that is definitely not an option then you will have to suck it up unless you can find an alternative means without going to court such as complaining to the ICO. 

saajan_12

Sounds similar to what happens in many attractions and ski slopes. To avoid people sharing season passes, they automatically take pictures of the person right when the pass is scanned. If it doesn't match the picture / height / etc of prior pictures then it'll flag up to an attendant, who manually checks and lets the person in or not. 

The software seems to throw up false alerts often enough (through probably still under 1% at a guess) . At least the human seems to use their judgement better. Eg when a friend of mine scanned a pass in a very busy gateline because people were so close and it took the picture of the person behind. 

Jenni_D

Ref. SAR ... as it stands the companies have no name for the OP, so how will they service a SAR? The OP attaches a photo to their SAR? (And the process of making a SAR will present further data to the company(ies) than they currently hold - something the OP has already said they're uncomfortable with).

user1977

A_Geordie said:

nero33 said:

Not interested in legal action but would like to see their evidence and ideally be removed from their most wanted list

In that case you should write to Facewatch and exercise your data subject rights to make a subject access request together with a erasure request. 

Isn't the problem here that the OP can only demand erasure of their own data - not everybody else who looks like them?

booneruk

I was wondering, how would one execute a SAR by submitting a photograph. What about twins/doppelgangers? Also, if a name was provided how would that link to some random mugshot (or more likely a biometric fingerprint of a face) in the system.

Okell

Jenni_D said:

Ref. SAR ... as it stands the companies have no name for the OP, so how will they service a SAR? The OP attaches a photo to their SAR? (And the process of making a SAR will present further data to the company(ies) than they currently hold - something the OP has already said they're uncomfortable with).

user1977 said:

A_Geordie said:

nero33 said:

Not interested in legal action but would like to see their evidence and ideally be removed from their most wanted list

In that case you should write to Facewatch and exercise your data subject rights to make a subject access request together with a erasure request. 

Isn't the problem here that the OP can only demand erasure of their own data - not everybody else who looks like them?

booneruk said:

I was wondering, how would one execute a SAR by submitting a photograph. What about twins/doppelgangers? Also, if a name was provided how would that link to some random mugshot (or more likely a biometric fingerprint of a face) in the system.

These strike me as problems re submitting a SAR

B&M and Facewatch don't know who the OP is - just that they think he resembles someone banned from certain stores.  How do they know what is his data and what isn't?

It also highlights to me the unacceptable nature of this sort of vetting.

MeteredOut

 How do people get registered onto FaceWatch? I assume individuals at each store can do that?

OP said they went into that B&M previously with a relative, but left without buying anything and went to another shop. Could someone at B&M have erroneously flagged them as suspicious, so the issue here is not a look-a-like but an erroneous flagging?

MattMattMattUK

Aylesbury_Duck said:

Presumably you simply look very like someone who has caused a problem.  I doubt there's anything you can do about it, and nor do I expect them to be inclined to do anything, either.

Looking like someone should not really be a factor, but it depends on the quality of the facial recognition technology.

Aylesbury_Duck said:

How good is the technology?  I'd have some fun and go back to B&M in glasses or a fake beard to see what happens.

Facial recognition tech can be as simple as being defeated by someone frowning whilst walking past the camera, to being able to differentiate identical (monozygotic) twins. It depends on what and how many reference points it uses, whether it is just visible light or also uses IR and UV etc. Their website is big on buzzwords and almost entirely lacking detail so hard to tell, but I imagine it sacrifices accuracy for speed of processing and to reduce both the processing power required as well as the bandwidth requirements. 

The only accuracy example I can find for FaceWatch is that the Met Police facial recognition has a false positive rate of 0.012% under operational conditions sampling 200 faces per second in a crowd. The FW system quotes an "accuracy rate" which is different as it can include false negatives as well, "up to 99.87%" but gives no data on the sampling rate. So the Met system has a false positive rate of about 1-in-8,000, the FaceWatch system give an inaccurate result at a rate of about 1-in-750 (false positive and false negative combined).