all articles
ai · 5 min read

Facial recognition and smart glasses: privacy risks for businesses

Understand how facial recognition can expose personal data and assess minimization, access controls and privacy review before a business pilot.

Cameras in glasses and phones, combined with face-search services, can make it possible to identify a stranger from a single image. For most businesses the practical question is narrower: whether to pilot facial recognition for something like door access, time clocks or event check-in, and what happens when staff bring camera-equipped devices into work. This article is a risk assessment to help you decide. It is not legal advice and not a how-to.

Why faces are different from other personal data

A password can be changed after a breach. A face cannot. Facial recognition also works at a distance, often without the person knowing it is happening, and it makes mistakes that land on specific people.

Regulators treat it accordingly. The UK Information Commissioner's Office (ICO) says that if you use a biometric recognition system you are processing special category biometric data, so you need both a lawful basis and a separate special category condition. The European Data Protection Board (EDPB), in a 2024 opinion on facial recognition at airports, said biometric data are particularly sensitive and their processing can create significant risks for individuals, and that people should have maximum control over their own biometric data.

In the US, the Federal Trade Commission's 2023 policy statement on biometric information names facial recognition directly and notes it may have higher error rates for certain populations.

The smart-glasses problem: bystanders

Wearable cameras change who is exposed. The person wearing the glasses agreed to the device's terms. The people in front of them did not. If an employee records customers, colleagues or visitors and runs those images through a face-search tool, your business may be the one answering for it.

Two points from the EU AI Act are worth knowing even if you are outside the EU, because they show where regulators draw hard lines. Article 5 prohibits AI systems that create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage. It also prohibits AI systems that infer people's emotions in the workplace and in education, with exceptions for medical or safety reasons. The European Commission says these prohibitions have applied since 2 February 2025.

What to do about it is mostly policy, not technology:

Decide whether camera glasses and similar devices are allowed in client meetings, on the shop floor and in back-office areas.
Ban the use of face-search services on images of customers, staff or the public unless counsel has approved a specific purpose.
Tell staff what to do if a visitor objects to being recorded.

Lessons from enforcement

The FTC's biometric policy statement lists practices it will look at when deciding whether a business's use of biometric information is unfair. Paraphrased:

Not assessing foreseeable harms before collecting biometric data
Not promptly addressing known or foreseeable risks
Collecting or using biometric data in surreptitious or unexpected ways
Not evaluating the vendors and other third parties who handle the data or run the technology
Not training staff who work with the data or the system
Not monitoring the technology to confirm it works as expected

The Rite Aid case in December 2023 shows how these play out. The FTC said the retailer deployed facial recognition in hundreds of stores without testing its accuracy, allowed low-quality images that increased false alerts, did not track false positives, did not train staff adequately and did not check its vendors properly. The FTC also said the system falsely flagged consumers as shoplifters, with more false positives in plurality-Black and Asian communities. The settlement banned Rite Aid from using facial recognition for surveillance for five years and required deletion of the images and of anything built from them.

Read that list as a checklist of what a small pilot also needs to get right.

A pre-pilot risk assessment

Work through these before signing with any vendor. Write the answers down; the document itself is evidence of care.

Purpose and necessity

What specific problem does this solve, and how is it solved today?
Is there a less intrusive option, such as a badge, PIN or staffed check-in? The EDPB's airport opinion urged operators to choose less intrusive ways to reach the same goal.

Data map

What is captured: images, templates, logs of matches?
Where is it stored, who holds the keys and for how long is it kept? The EDPB found that only storage where the individual holds the data or the encryption key could be compatible with the principles it examined.
Which vendors and sub-processors touch it?

People and choice

Who is enrolled, and who is scanned without being enrolled?
What is the alternative for someone who says no? The ICO says that where you rely on consent you must offer a suitable alternative, and that employers should think carefully about whether consent is appropriate given the power imbalance.
How are people told, before they are scanned?

Accuracy and errors

What test evidence does the vendor provide, and on what population?
What happens after a match or a failed match, and who reviews it before any action is taken?
How will you record false matches and complaints?

Security and access

Who can see images and match results?
How are templates protected, and how is deletion confirmed?

Review and stop criteria

Who signs off: someone with authority, after legal review?
What result ends the pilot early: an error rate above an agreed threshold, a complaint pattern, a security incident?

Processing like this may also require a formal data protection impact assessment; the ICO's biometric guidance has a section on exactly that question. Check with counsel which law applies to you and what it requires. The ICO, EDPB and FTC pages below are good starting points for the questions counsel will ask.

When the answer is no

Many of the use cases that bring businesses to facial recognition have simpler answers. Door access works with cards or phones. Time clocks work with PINs. Event check-in works with a QR code and a person at the door. If the assessment shows a less intrusive option that does the job, that is usually the end of the discussion.

Where automotif fits

We do not build facial recognition systems. Where we help is AI enablement: working with your team on a written policy for AI tools and camera-equipped devices at work, and a playbook for assessing any AI pilot before it touches personal data. Legal questions stay with your counsel. To talk it through, book a free call of 30 to 60 minutes.