A popular café in Delhi-NCR has recently introduced facial recognition technology to facilitate faster customer experience. It can be often observed that small companies who are engaged in food chain businesses are coming up with concise yet strategic business models to enhance their buyer response. In the process of this development, they often keep experimenting with new technologies. Facial recognition is one of such feature.
The use of facial recognition is becoming popular worldwide as they are being used for a range of applications. However, successful implementation of this feature in India depends upon a number of factors. User response, economic feasibility and hassle free experience are some of these factors. Above all the prime factor of consideration would be the existing laws on the above issue.
Facial Recognition and the Data Protection Bill, 2018
The Union cabinet recently passed the Personal Data Protection Bill, 2018 (hereinafter referred to as the ‘Bill’). The enactment of this Bill could possibly impact the use of facial recognition feature by the companies.
Clause 3 (7) of the Bill defines ‘biometric data’ and includes ‘facial images’ as part of biometric data. Further Clause 3 (36) of the Bill categorizes ‘biometric data’ as ‘sensitive personal data’. The Bill classifies data into three categories namely critical, sensitive and general. As per Clause 33 of the Bill, a ‘sensitive personal data’ may be transferred outside India, but such sensitive personal data shall continue to be stored in India. Nevertheless, transfer of ‘sensitive personal data’ shall be subject to conditions laid out in Clause 34 of the Bill.
Now, on the basis of the above, it can be reckoned that the use of facial recognition feature would be classified as ‘sensitive personal data’. In future when the Bill receives the assent of the President, any company wanting to use the facial recognition feature, would have to comply with provisions applicable as per the law.
Even though use of this feature is convenient for both the customer and the company, there can be different ways in which a customer can perceive it. While many can find it welcoming, there can be a set of customers who would dissent this view. The segregation of data can then be an uphill task for the company. Therefore, companies interested to use facial recognition feature should devise a framework for storing and processing of data in consultation with a legal expert so that the Company operates its business at ease.
Involvement of personal data like facial recognition algorithm can expose the information safety of the company to a larger risk. An eventual data breach can lead to misuse of personal information and can also invite litigation against the company. However, the introduction of the Bill can facilitate markets for Indian data processors and the Companies can effectively operate taking assistance from these data processors.
While data protection is the need of the hour, it is also important that business organizations are able to operate smoothly. A balance should be stricken between data protection and business operations involving personal for both enhanced consumer experience and economic growth. Further, the Bill is expected to boost data processing markets, in this regard it will be interesting to see how the government frames plan for the development of the same.