Guide to safe and ethical use of facial recognition technology published

The use of Artificial intelligence (AI)-powered facial recognition tools is increasingly common, including for security purposes such as at King Charles’ Coronation or major sporting events and to curb shoplifting.

In essence, facial recognition technology maps an individual’s physical features in an image to form a face template, which can be compared against other images stored within a database to either verify a high level of likeness or identify an individual’s presence at a specific location at a given time.

The BSI’s recent research showed that 40% of individuals globally expect to be using biometric identification in airports by 2030. Its proliferation has prompted concerns about safe and ethical use, including around error rates linked to racial or gender differences, as well as high-profile legal cases, among them one involving software used by Uber.

An audit conducted in 2022 assessed the police service’s use of facial recognition, finding that deployment regularly failed to meet minimum ethical and legal standards.

BS 9347:2024

BS 9347:2024 Facial Recognition Technology – Ethical Use and Deployment in Video Surveillance-Based Systems – Code of Practice has been developed by the BSI in its role as the UK’s national standards body to assuage concerns by helping organisations navigate the tools and build public trust. Its publication follows on from the BSI’s Trust in AI poll, which showed that 77% of those individuals surveyed believe trust in AI is key for its use in surveillance.

Designed for both public and private sector organisations using and/or monitoring video surveillance systems and biometric facial recognition technologies, the Code of Practice is applicable to the whole supply chain, beginning with an assessment to determine the need to use facial recognition technology right through to its procurement, installation and appropriate usage.

BS 9347:2024 sets out six key overarching principles of ‘trustworthiness’. These are backed up with a summary of policies that are required and to be maintained by those across the supply chain. The guide covers facial recognition technology’s applicability across governance and accountability, human agency and oversight, privacy and data governance, technical robustness and safety, transparency and explainability, diversity, non-discrimination and fairness.

With the industry expected to be worth $13.4 billion globally by 2028, the standard sets out the importance of regularly reviewing the ethics of AI and its application in facial recognition technology. It embeds Best Practice and gives guidance on the appropriate guardrails for safe and unbiased use of facial recognition technology through the definition of two scenarios: identification and verification. For the former, such as identifying individuals in crowds at events, the standard requires that facial recognition technology is used in conjunction with human intervention or ‘human-in-the-loop’ measures to ensure accurate identification before action is taken.

In verification scenarios where the technology can operate autonomously, such as in the case of building access control, authenticating a payment transaction or opening a smart phone, the British Standard puts guardrails in place for the technology’s learning by ensuring training data includes sets from diverse demographic pools and across a variety of lighting levels and camera angles to eliminate inaccuracies and mitigate the risk for bias by way of false positives.

Driving force for good

Scott Steedman, director general for standards at the BSI, said: “AI-enabled facial recognition tools have the potential to be a driving force for good and benefit society through their ability to detect and monitor potential security threats. This Code of Practice is designed to help organisations navigate the ethical challenges associated with the use of facial recognition technology and build trust in its use. It aims to embed Best Practice and give guidance on the appropriate guardrails organisations can put in place to protect civil rights and eliminate system bias and discrimination.”

Dave Wilkinson, director of technical services at the British Security Industry Association (BSIA), explained: “The use of facial recognition technology has not come without its own challenges, whether that has been down to the accuracy of the technology or how and where it’s deployed. Many relevant questions have been asked by privacy groups, industry stakeholders and other interested parties on the appropriate and proportionate use of such technology.”

Wilkinson continued: “This Code of Practice aims to instil trustworthiness in the use of facial recognition technology by setting out key principles covering the whole process from assessing the need to use it through to ensuring its continued operation remains fit for purpose and justified.”

In addition, Wilkinson noted: “Aligned to the understanding of developing regulation both here in the UK and the wider international regulatory landscape, the Code of Practice sets out to build trust with those who develop and use such technology and also those who are subject to its use.”

The BSIA’s leadership on this issue began in 2020 with the establishment of a Special Interest Group, with the Trade Association subsequently publishing the industry-first ethical and legal guide on facial recognition. The latter was acknowledged by central Government and was the initial template for developing the new British Standard.

Leading the way

Pauline Norstrom, CEO of Anekanta Consulting and Anekanta AI and also chair of the BSIA’s AI and Biometrics Special Interest Group, stated: “The release of the facial recognition technology Code of Practice is a significant moment in the journey towards the ethical use of AI-based biometric technology in the UK. As the first of its kind in the world, it shows that British industry is leading the way in this work with a procedural standard written for developers, integrators, deployers and stakeholders.”

Norstrom went on to comment: “It’s different to other standards for AI and biometrics as a non-technical Code of Practice that operationalises the principles for trustworthy AI (ie ethical AI) through the entire value chain, making it easy for industry to implement transparently with clear governance and accountability and, arguably, with potentially lower impacts, risks and costs.”

In addition, Norstrom said: “Crucially, the British Standard contains a metaphorical ‘stop button’ designed to cease use if impacts cannot be mitigated. It also frames facial recognition technology as an AI technology which aligns with the definition of AI in international standards as well as either new or pending regulation.”

*Copies of BS 9347:2024 are available online