Passkeys can be lost or stolen, and entry codes can be “lent out” or hacked. Could facial recognition be the best technology for controlling access to restricted areas? In this article, you’ll find out how facial recognition technology works and gain some extra tips and tricks for access control enhancements that keep your limited-access areas safe from intrusion.
How Facial Recognition Systems Work
To set up your system, you’ll need a combination of camera monitoring and facial recognition software.
To register personnel’s facial features on the system, images are captured and processed. The software creates a digital representation of the face, noting details like the distance between the eyes and the shape of the nose. Once this template has been created, you can set access permissions based on the person’s role.
When a personnel member approaches an access control point, cameras capture imagery, processing it to enhance image quality and eliminate extraneous information. The new image is compared to the digitised template, and access is granted if a match is detected.
AI in Facial Recognition
AI enhances facial recognition technology in several ways. For example, it’s able to use deep learning to identify variations caused by changing lighting and facial expressions. This means that personnel are less likely to be denied access just because lighting is poor or their facial expression is not neutral.
Early forms of facial recognition technology could be fooled by people wearing masks, or even by holding a photograph up for scanning. Overcoming this, AI is able to use “liveliness detection” to distinguish between still images, masks, and real faces, making it harder to bypass the system.
In addition, AI can determine whether anything looks out of place. For example, if personnel usually enter high-security areas alone, it can alert supervisors to the presence of other people. It can also check for unusual behaviour like attempting access at an unexpected time of day.
Benefits of Facial Recognition Access Control
There are obvious benefits to facial recognition access control, and enhanced security tops the list. It’s also a very efficient and convenient system that eliminates the need to do anything other than stand within camera range. For example, a person who has their hands full of equipment can easily pass an access control point without pausing to free up their hands.
Remote monitoring indicates anything anomalous, allowing human security personnel to double check access requests that seem strange. If there are clear signs that something is amiss, integration with other systems can allow alarms to be sounded, and records of people’s comings and goings can be accessed in case of an investigation.
Challenges When Implementing AI Facial Recognition
Privacy concerns are among the top challenges organisations hoping to implement facial recognition technology face. Many workers are concerned that it may be doing far more than just granting access to restricted areas.
Workers also worry about accuracy, with justifiable concern from people with darker skin tones as some forms of this tech are less accurate when analysing their features. During the early 2020s, several US jurisdictions banned the use of facial recognition technology in the face of privacy and discrimination concerns.
In the UK, using facial recognition is allowed, but there are compliance issues to consider. For example, employees must be informed on how facial recognition will be used and must give their consent before it can be implemented. In addition, privacy and data protection rights must be safeguarded. This affects important details like who would be authorised to access recorded data, how long it can be retained, and how it should be safeguarded from theft.
In a 2024 court finding, the Information Commissioner’s Office (ICO) stated that companies should offer employees the option of using alternative, “less intrusive” methods when the use of biometric information could not be proven an operational necessity.
When Can UK Organisations Use Facial Recognition for Access Control?
To comply with General Data Protection Regulations (GDPR), the scenario in which facial recognition is used must match specific requirements.
Lawful Basis and Consent
There are some situations in which the greatest caution in access control is within the public interest. For example, it would be in the public interest to ensure that only authorised personnel can access nuclear power station control rooms.
In the absence of “lawful basis” consent is the primary requirement for using facial recognition and other biometric technologies. Consent should be “freely given” meaning that it cannot be dictated as a requirement workers must fulfil. Instead, employers offer an alternative and allow employees to make their decisions based on their own convictions and opinions.
Transparency and Purpose Limitations
Under GDPR, data subjects must know how their data will be collected and processed. This requires signage in areas covered by cameras as well as consultations with workers who are not included in the access control system but may nevertheless be captured on film.
Personal data, including facial recognition data, can only be used for clearly specified purposes. So, if you are implementing facial recognition for access control, no other application would be lawful without explicit consent from employees.
Privacy Impact Assessments
To ensure that personal biometric data is safe and that risks to data subjects are minimised, a privacy impact assessment should be conducted. As part of this, the risks for the organisation and its employees must be carefully considered and addressed. For example, organisations must consider the risk of data being accessed or used for purposes other than access control and work to minimise the risk of privacy breaches.
Processing Limitation and Data Security
Apart from ensuring that biometric data is only used for its specified purpose, organisations may not store or process data from employees who did not consent to facial recognition for access control. For those who have given consent, it will be important to safeguard their information using measures like encryption and password authentication. Company policies should indicate the parameters under which data can be accessed.
Data Minimisation and Retention
The less data is stored, the lower the risk for all concerned. To remain compliant, organisations must collect, process and store the absolute minimum amount of data required for face recognition to serve its purpose. A company providing facial recognition systems will be able to advise its clients on the necessary data governance protocols to follow.
Data Security
Biometric information is sensitive personal information. Under GDPR, organisations must exercise due diligence in safeguarding it, adding cybersecurity measures to the compliance checklist. Once again, professional advice will be helpful.
Is Your Organisation Ready for Facial Recognition Access Control?
Despite recent crackdowns, biometrics for access control raises fewer concerns than using facial recognition for employee monitoring. In a statement the ICO said:
“Rather than unilaterally imposing top-down policies, we encourage businesses to evaluate their options and secure genuine employee buy-in before considering biometric.”
In addition, it notes that when tight security is in the public interest, and in instances where other access control methods have been implemented but abused, employers may have a case for insisting on facial recognition for access control. However, the bar for this is high, and owing to the complex regulatory landscape, consultation with professionals to assess compliance is recommended.
All in all, the best approach to deciding whether your organisation is ready for facial recognition access control will be through a process of consultation. Demonstrating the convenience and added security it offers and being transparent about how the technology will be used and how personal data will be managed may well allay employee concerns.
If you’re interested in implementing this technology in the workplace, Advantex is at your disposal. We have in-depth knowledge of the technology and infrastructure needed to support it. Book a consultation today.
