Facial Recognition at Entry and Where It Is Prohibited

Understanding Facial Recognition Technology

Facial recognition systems use artificial intelligence to identify individuals by analysing facial features from photographs or video feeds. In hospitality settings, these systems can be deployed at entry points such as hotel lobbies, restaurant entrances, or event venues. The technology typically involves cameras capturing images, software processing these images against stored databases, and providing identification results within seconds.

Staff members should understand that facial recognition operates through pattern matching algorithms that compare facial data with existing records. The process involves capturing a face image, extracting key facial landmarks, and converting these into mathematical representations called faceprints. These faceprints are then compared against stored templates to find potential matches.

Management must ensure staff recognise that facial recognition systems have limitations. Accuracy rates vary significantly depending on lighting conditions, camera quality, facial expressions, and demographic factors. The technology may struggle with children, elderly individuals, or those with significant facial changes due to ageing or injury.

Prohibited Applications and Legal Framework

Facial recognition technology faces strict limitations in hospitality environments. The Information Commissioner’s Office has identified several prohibited uses including automatic surveillance of public spaces without explicit consent. Hotels cannot implement facial recognition systems that monitor guests’ movements through common areas without clear notification and opt-out mechanisms.

• Automatic surveillance of guests in hotel corridors or common areas
• Monitoring of guests’ emotional states or behavioural patterns
• Use of facial recognition for discriminatory purposes
• Implementation without proper data protection impact assessments

ISO 27701 clause 8.2.3 requires organisations to maintain records of data processing activities. Hospitality businesses must document any facial recognition usage, including purposes, data retention periods, and access controls. The General Data Protection Regulation also mandates that facial data constitutes special category data requiring additional safeguards.

Staff should know that using facial recognition for guest identification purposes requires explicit consent. This consent must be freely given, specific, informed, and unambiguous. Hotels cannot rely on standard booking terms that include facial recognition unless guests have clearly opted in through separate, dedicated consent processes.

Implementation Guidelines and Best Practices

When facial recognition systems are legally permissible, hospitality businesses must implement them with careful attention to privacy protection. The system should only capture facial data at designated entry points where guests have reasonable expectation of privacy. Cameras must not record areas such as guest rooms, bathrooms, or changing facilities.

Implementation requires staff training on proper usage protocols. Employees must understand that facial recognition data should be stored securely using encryption and access controls. Regular audits of data access logs must occur to ensure no unauthorised individuals access facial databases.

• Ensure cameras are positioned to capture faces only at designated entry points
• Implement automatic data deletion after specified retention periods
• Train staff on proper camera positioning and maintenance
• Establish clear procedures for data access authorisation

Management must establish clear policies regarding facial recognition usage. These policies should specify when and where the technology operates, who can access the data, and how guests can request data deletion. Staff should know that guests have the right to request information about facial data processing and can withdraw consent at any time.

Regular technical reviews ensure systems maintain compliance with data protection requirements. Testing should verify that facial recognition accuracy meets operational needs while minimising privacy risks. Staff must understand that any facial recognition implementation requires approval from data protection officers or designated privacy personnel.

Organisations should maintain detailed records of facial recognition usage including dates, purposes, and data subjects involved. These records support compliance with data protection obligations and demonstrate good data governance practices. Regular staff refreshers ensure continued understanding of proper facial recognition handling procedures.