Facewatch Privacy Notice
Facewatch Limited is a company limited by shares registered in England under company number 7209931 whose registered office is at High Street, Hadleigh, Ipswich, Suffolk IP7 5EA.
If you wish to exercise your privacy rights, have any questions, suggestions, concerns or complaints please contact our Data Protection Officer by emailing [email protected] or by calling 0207 9303225.
We operate under the Data Protection Act 2018 incorporating the UK General Data Protection Regulations (collectively referred to below as the DPA).
What we do
We provide systems and process personal data and special category personal data for the prevention and detection of crime.
Facewatch are the Data Controller for all personal data we process. Our customers are businesses (subscribers) who must display signage saying that Facewatch facial recognition is in operation.
The Facewatch Real Time Alerting system uses facial recognition to instantly alert a subscriber when a person reasonably suspected of involvement in crime (a Subject of Interest – SOI) enters their premises. See below for a fuller description of a SOI.
Subscribers are able to report new SOIs through incidents of crime which include a formal witness statement to justify an offence has taken place and the reasonable grounds to suspect the SOI as responsible. Facewatch reviews every incident to ensure both are demonstrated. The Subscriber can only view incidents and SOIs that they have uploaded.
Your rights under the DPA are as follows:
- The right to be informed – we will fulfil your right to be informed of details of our processing and your rights through our signage at the entry point of a Facewatch subscriber premises and in this privacy notice available on our website and in subscriber premises.
- The right to rectification – we will fulfil your right to rectify any inaccurate personal data concerning you.
- The right to erasure – Article 17 UKGDPR lists the circumstances where you have the right to be forgotten and have data concerning you erased from our records. We will fulfil this right where it exists in the listed circumstances.
- The right to restrict processing – Article 18 UKGDPR lists the circumstances where you have the right to obtain from us a restriction of processing. If one of these circumstances apply we will restrict our processing of your personal data in the ways required by Article 18.
- The right to data portability – this right is not applicable in our processing activity.
- The right to object – we will fulfil your right to object to us processing your personal data where the requirements of Article 21 UKGDPR apply.
- Rights in relation to automated decision making and profiling – this right is not applicable in our processing activity due to the meaningful human involvement in decision making during our processing.
- Right of access: The right of access – you have the right to submit a Subject Access Request in order to obtain from us confirmation as to whether or not we are processing your personal data. Where this is the case we will provide you with a copy of your personal data and additional information required by DPA. A subject access request can be made here or by email to [email protected]. We will need to obtain proof of your identity before providing you with information we hold about you.
- You have the right to submit a complaint to the Information Commissioners Office at www.ICO.org.uk
If you require more information about items raised in this notice we would recommend the ICO website.
This privacy notice includes the following information to help you understand clearly how your data is being used.
Explaining AI Decisions
The Facewatch System examines facial images collected by a dedicated customer’s CCTV camera of everyone entering a subscriber premises and utilises an AI software application to compare the biometric data of those images to a database of SOIs held by Facewatch.
Where there is a match, the output of the application is a recommendation in the form of an alert that an image may match that of a SOI.
This information is provided to assist a human review by the person receiving the alert who will have sight of the relevant person and be in a position to decide if they consider the match to be accurate. If the person receiving the alert considers the alert image matches the person subject of the alert, they will implement their organisational procedure for responding to a matched alert. This action can range from no action to an intervention.
If the recipient doesn’t consider the alert is a match they can click “no match.” The alert and biometric data of the face are deleted instantly.
In effect the algorithms are simply there to filter potential matches to a very high degree of accuracy and then humans take over.
Whose personal data we process
The data we process is different depending on who you are:
We explain below what personal data we process and how we use that data using the above definitions.
Subjects of Interest (SOIs)
We hold personal data about SOIs for the purposes of the prevention and detection of unlawful acts.
Subscribers upload information about an SOI. This is only accepted by Facewatch where there are reasonable grounds to suspect that the individual is responsible for an unlawful act. This is strictly controlled and anyone who uploads any data which is not compliant could be subject to fines or censure by the ICO.
Facewatch maintains a database of SOI facial images and the reasons for their being reasonably suspected of crime.
We convert the facial images captured by CCTV of persons entering a subscriber premises to facial recognition algorithm templates which are then used to compare to the facial recognition template of our database of SOIs and create alerts if there is a potential match. We do not send alerts to subscribers that do not meet our high accuracy standards – all alerts are double checked with a second algorithmic check before sending and only sent if there is at least a 99% similarity or a Facewatch facial analyst considers there is a match. The alert is then verified by the relevant Facewatch subscriber before acting on the alert. If no verification is entered the alert is deleted from the user portal within one hour. If an alert is marked as a no match it is deleted instantly from the user portal. In order to audit system accuracy CCTV images and non biometric personal data are retained for up to 7 days. All alerts are checked for accuracy by our Facial Analysts.
We share a subset of SOI personal data with our Subscribers when a facial recognition alert is generated by our system, comprising: facial image(s); alert date; the percentage of certainty that the images are a match and a gallery of images held of the subject of interest; offence type and any warning markers (e.g. violence) which is the minimum amount of data we believe we can share to achieve the purposes noted above. Using automatic age estimation, we choose not to record as SOIs nor generate alerts for children under 18 or adults aged 80 or over unless, by their recorded actions, they pose a threat to the safety of others or themselves.
We share the SOI data with a subscriber premises when a facial recognition alert is generated for those premises based on what we believe is adequate, relevant and necessary for achieving the purpose of preventing and detecting crime. A subscriber may only see SOI images in incidents that they have uploaded.
The lawful basis for processing SOI personal data is that it is in our legitimate interest and that of our subscribers to do so.
We have to comply with a higher threshold of compliance when processing criminal offence data and using facial recognition algorithms, which are deemed to be Special Category data under UKGDPR. We lawfully process this data because we are able to demonstrate that it is necessary in the Substantial Public Interest for us to do so. The substantial public interest is the prevention and detection of crime.
We retain SOI data for a period of up to 12 months from their last recorded incident other than SOIs with incidents involving Weapons or Assault Causing Bodily Harm or Threat of either which are retained for two years. Findings of no crime, not guilty or cessation of proceedings will lead to removal of that incident record against the SOI.
SOI alert records are retained for 48 hours to enable the audit processes to take place.
When an alert has been generated the biometric data of the match is always deleted instantly to ensure no tracking is possible.
Members of the Public
Before you enter a business protected by the Facewatch Real Time Alerting system you will see signage saying that Facewatch facial recognition is in operation.
The Facewatch Facial Recognition System works by detecting faces from CCTV sited at our subscriber properties. These images are fully encrypted and transmitted to our highly secure Cloud server where they are converted into a set of facial biometric measurements which are then compared to the Subjects of Interest on our database. If there is no match the biometric data is instantly deleted thereby protecting the data of anyone not on the SOI database.
We retain detected faces from the camera feed for up to 7 days so that images of individuals reasonably suspected of crime or disorder can be uploaded after the event to the Facewatch system. No biometric data is retained for anything more than an instant other than that of Subjects of Interest.
The lawful basis for processing your personal data is that it is in our legitimate interest and that of our subscribers to do so for the purpose of the prevention and detection of unlawful acts. We have taken every precaution to ensure that it is not disproportionately intrusive on your privacy.
We have to comply with a higher threshold of compliance when processing using facial recognition algorithms which are deemed to be Special Category data under GDPR. We lawfully process this data because we are able to demonstrate that it is necessary in the Substantial Public Interest for us to do so. The substantial public interest is the prevention and detection of crime. We never hold your biometric data for more than an instant, and no-one can ever track where you have been using our system.
Other Recipients of Personal Data
Facewatch use AWS UK servers to host our processing operation which includes use of AWS facial recognition software as a service as a secondary check for accuracy alongside our own software. This processing is conducted using a non-storage API operation in which the software does not retain any information discovered about the input image.
Our Legitimate Interests
The legitimate interest for processing all persons entering subscriber premises to compare against a database of persons reasonably suspected of committing unlawful acts is the compelling justification for us to provide a service to protect our subscribers, their customers, staff and business assets from unlawful acts. Our Legitimate Interest Assessment is as follows:
It is our legitimate interest, and that of our subscribers, to prevent and detect crime against subscribers, their staff and customers by processing personal data to identify persons in subscriber premises who are reasonably suspected of having committed crime and thereby enable reasonable and proportionate action to prevent crime.
The processing of personal data, special category data and criminal offence data is necessary to achieve our legitimate purpose as it allows us to provide facial recognition services to quickly and accurately identify individuals who are reasonably suspected of having committed crime, and to notify relevant subscribers so as to take reasonable and proportionate action in the circumstances. Without processing information in this way we would be unlikely to effectively identify such persons as they enter subscriber premises, making subscribers less likely to prevent unlawful acts, and therefore more likely to experience crime.
In pursuit of our legitimate purpose, through our policy and procedures, we balance our legitimate interest with the rights, interests and freedoms of all affected data subjects by performing minimal intrusion on privacy rights and facilitating their general interest to be protected from crime. We distinguish those individuals reasonably suspected of having committed unlawful acts from all other persons entering subscriber premises by the use of our SOI database. All alerts are checked by a trained Facewatch employee to verify an alert for accuracy. There is human involvement by the subscriber to verify Facial Recognition Alerts for accuracy before taking any action.
We prevent function creep and ensure data quality and minimisation by requiring subscriber adherence to the terms and conditions of the use of the Facewatch System and Facewatch data sharing agreement.
Our privacy notice reflects the use of the Facewatch System and thereby informs individuals on what happens to their personal data. It is important to note that the Facewatch System protects the privacy of individuals and only alerts subscribers to the presence of individuals whose image matches that of individuals reported as having committed crime in a defined area relevant to the subscriber and the crime committed.
Facewatch Ltd is a distinct data controller and we have a data sharing agreement with subscribers.
General Enquiries/Communications
If you complete a survey or a form on our website requesting information or call us or submit a subject access request we will retain that data for a maximum of 6 years and use it to follow up with you. The rationale for this period of retention is to comply with the Accountability Principle whereby we must be able to demonstrate our compliance with the DPA. We delete any proof of identity information provided for fulfilment of a subject access request as soon as your identity is verified.
We will retain your email address and name for marketing purposes only if you have opted into this service but this will not be shared with any other organisations.
You can opt out of marketing emails at any time and request us to delete your information at any time using the SAR process explained above.
A record of your telephone calls and e-mails to us may be recorded in our contact management system and may be retained for up to 6 years. We may also intercept communications made to individual members of staff at Facewatch when this is required for business purposes.
The lawful basis for processing your personal data is that it is both necessary and in our legitimate interest and that of those who communicate with us to do so for the purpose of the efficient conduct of our business.
We balance our legitimate interest against the individual’s interests, rights and freedoms and only use such personal data for the efficient conduct of our business.
Cookies
Our website uses cookie preference management software.
We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services.
To see the full Cookie Declaration and manage Cookie preferences, click here
Changes to the Privacy Notice
From time to time we may amend the way in which we process personal data. This may lead to changes in how we collect and/or use your personal information.
We may amend the terms of this Privacy Policy at any time. Please check this page periodically.
Other Websites
We are not responsible for the privacy policies and practices or the content of any websites which are linked to our Website.
Contact us
If you have any queries relating to this Privacy Notice, please contact us by e-mail at: [email protected] or call 0207 9303225.
Mobile Apps
ASSOCIATIONS
Commercial Partners
