For Heads-of · Practitioner
Untargeted facial recognition scraping
Facial images are scraped from the internet or CCTV footage without targeting, to build or expand a facial recognition database.
- critical
- prohibited-practice
- biometric
- facial-recognition
- eu-ai-act
How it happens
A system or process indiscriminately collects facial images from public internet sources or camera footage, without any pre-existing target or lawful basis specific to those individuals, purely to grow a facial recognition dataset.
Why it matters
The absence of targeting is the distinguishing feature: this isn't a case-by-case investigative tool, it's mass, non-consensual biometric data collection at a scale no individual could reasonably anticipate or object to.
Mitigating controls
The controls that address this risk, ranked by effectiveness.
No controls mapped to this risk yet.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| EU AI Act | Article 5(e) | Untargeted facial recognition scraping |
| UK General Data Protection Regulation | Article 5 | Principles relating to processing of personal data |
Related resources
The external sources behind this risk, from the Resources library.