Opinion Concerning the Legal Restrictions on Facial Recognition Systems

Opinion (full text)(PDF;166KB)

• Japanese

    September 15, 2016

Japan Federation of Bar Associations

 

The Japan Federation of Bar Associations (“JFBA”) prepared its “Opinion Concerning the Legal Restrictions on Facial Recognition Systems” on September 15, 2016, and on September 16, 2016, submitted such opinion paper to the Commissioner General of the National Police Agency, the Chairman of the Personal Information Protection Commission, and the Prime Minister, as well as prefectural governors and mayors of cities designated by government ordinances.

 

Summary of the Opinion

1.  The opinion concerns the system whereby the police collect facial image data from an unspecified number of people nearby a crime scene, generate quantified data of characteristics to specify each individual (hereinafter referred to as “facial recognition data”), and conduct searches in a pre-generated database of facial recognition data of specific people (hereinafter referred to as a “facial recognition database”), which is used to match the identity of suspects or other persons. In regard to this system, it is the opinion of the JFBA that the nation should establish laws that incorporate the items listed below, amend relevant legislation and undertake similar measures to enact appropriate regulations, as well as recognize the guarantee of access rights for suspects, defendants and those in similar circumstances.
   
   (1) Limitations on Usage Conditions
   
   (i) Collection of facial image data recorded via security cameras or the like, for the purpose of criminal investigation by the police, should be conducted by court order (however, this would exclude facial image data from stores or other facilities, where such equipment has been legally installed in an area where the installer has authority).
   
   (ii) Generating facial recognition data from images nearby a crime scene should be limited to those instances required for investigation of organized crime, where the crime infringes upon paramount public interests (hereinafter referred to as “serious organized crime”). In this case, facial recognition data that has been legally generated should be destroyed as soon as it is no longer required for said investigation.
   
   (iii) Where use is permitted for facial recognition data generation from facial image data of suspects, previously convicted persons, or the like, whose facial image data is already in the legal possession of police, such use shall be limited to those with a previous conviction for serious organized crime.
   
   (iv) Facial recognition data registered in the facial recognition database should be limited to those with prior convictions for serious organized crime. Furthermore, registration periods should be established for such data, and this data should be deleted immediately after the end of such registration period.
   
   (v) Facial recognition database matching should be limited to such cases that require specific investigations for serious organized crime, and conditions for permitted methods should be clearly predefistances.
   
   (2) Monitoring by the Personal Information Protection Commission
   
   The Personal Information Protection Commission should be able to check whether facial image data collection, facial recognition data generation, usage and disposal, compiling of facial recognition databases, registration to facial recognition databases, usage status of facial recognition databases, and data deletion or the like from the facial recognition databases, are conducted in an accurate and appropriate manner.
   
   (3) Disclosure of Basic Information
   
   The mechanisms and search accuracies of facial recognition systems should be periodically published.
   
   (4) Rights of Suspects, Defendants and Those in Similar Circumstances
   
   The facial recognition system can provide a means for claiming an alibi for those not connected to the facts of the crime. Requests by suspects, defendants, and those in similar circumstances for matching using the facial recognition system should be recognized. Furthermore, those erroneously registered in the facial recognition system should have recognized rights to request disclosure and deletion.

    

2.  Until legislation incorporating the above is established, the Public Safety Commission should establish rules on facial recognition data that incorporate the measures set forth above, and should ensure that the application of this system is in accordance with such clearly stated rules. Prefectural police should also apply the system according to these rules.

    

3.  From the perspective of preventing violation of privacy rights in applying the facial recognition system, the administration should verify that there is no collection and usage of facial image data at accuracies beyond what is required, and that there is no unnecessary generation and usage of facial recognition data. Further, the administration should pay close attention to this point moving forward.
   Specifically, existing facial image data held by the prefectural public safety commissions should not be provided to investigatory bodies without a court order, nor should further facial recognition data be generated.