Mercadona’s facial recognition is already present in some 40 supermarkets in Mallorca, Zaragoza and Valencia. The AEPD learned of its existence through the media, and they have announced that it is in the stage of proceedings prior to the official investigation. They cannot give details yet, but they are aware of the event and are investigating it.
AnyVision: the system used by Mercadona
The facial detection system, in principle, identifies people who have a final judgment against Mercadona or restraining orders from their establishments or workers. Upon entering the store, there is a sign that Mercadona has implemented these systems, but it seems too great an effort for a very limited number of cases.
Image just taken from the informative poster on the facial recognition system in the Mercadona del Coll d’en Rabassa (Palma) – Balearic Islands. 👀#Data Protection#Facial recognition#RGPD@jgarciaherrero @apachecoabogado@Jorge_Morell@FelipeA_Herrera pic.twitter.com/VQ7nsRIFDp
– Jose Manuel Cañedo (@josecanedo_) July 2, 2020
Mercadona says that it is legal and that it does not store images, where the data disappears after 0.3 seconds. The problem is that, even in a short time, there is a use of that data. When a face is identified, a series of biometric patterns are collected, which is what is then compared to the database. It is similar to Face ID on iPhone, where the mobile does not save our face, but a fingerprint of it. When someone tests positive, the Mercadona security team alerts the authorities to go to the establishment.
Mercadona’s system is developed by the Israeli company AnyVision. That company has been involved in several controversies, and it was the one that led Microsoft to stop investing money in facial recognition last March, since it was discovered that AnyVision was using its technology to identify Palestinian citizens in the West Bank (the conflictive West Bank between Palestine and Israel). Thus, the system introduced in Spain has at least four failures:
Violation of privacy
This technology represents a serious violation of the Privacy of users, in addition to raising doubts about whether it complies with the RGPD and the data protection law. It is not known what database they use to collate the identifications, nor is the failure rate of the system.
False positives of facial recognition
The problem with technology is that it is not perfect. There is not yet a system that is capable of perfectly identifying people. Also, these systems have huge biases, where confuses quite often to black or Asian people. In 2018, Amazon tested the 535 members of the United States Congress, confusing 28 of them with the faces of criminals who were in the database. If we add to this that when entering the store we can go covered, with a cap or glasses, false positives can be triggered.
Violation of the right to honor
Furthermore, this can be a violation of the right to honor of citizens, where if the system mistakenly identifies as a criminal, the person will be detained in front of the workers or acquaintances, who may not know you as well and start treating you suspiciously from there, although later prove it was a false positive.
It is also not known if Mercadona has requested permission to the AEPD to install these systems. If the agency has claimed that it just found out about this system, it probably won’t have their approval. While there are cities that already prohibit the use of facial recognition, such as San Francisco since May 2019, in Spain there are still no regulations regarding these systems.