Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement

What it covers

This document analyses the use of facial recognition technology by law enforcement authorities, covering the technology's functions and risks, and the applicable legal framework under the EU Charter of Fundamental Rights and the Law Enforcement Directive, including lawfulness, special category data, automated decision-making, data subject rights and safeguards such as DPIAs, prior consultation and logging, illustrated with practical scenarios.

Why it matters

It is the primary EDPB guidance setting out when and how facial recognition may lawfully be deployed by police and other law enforcement authorities, addressing a technology with significant fundamental rights impact.

Refer to it when

• assessing the lawfulness of a proposed law enforcement FRT deployment
• conducting a necessity and proportionality analysis for biometric surveillance
• determining whether a DPIA or prior consultation is required for FRT
• evaluating data subject rights limitations in a law enforcement biometric processing context

Questions this document addresses

• What legal basis is required to deploy facial recognition technology for law enforcement?
• When is biometric processing considered strictly necessary under the LED?
• Does making a photograph public mean the derived biometric data is manifestly made public?
• What safeguards must accompany FRT deployment, such as DPIAs and prior consultation?

Topics

• Law enforcement
• Video surveillance
• Supervisory authorities
• DPIA & high-risk processing