A retail shop uses facial recognition to match customers against a shoplifter watchlist. Which characterisation best captures the GDPR risk level?
Select an answer to reveal the explanation.
Short Explanation
Face-matching shoppers to a watchlist is not “just another camera.” Biometrics for identification are special-category, high-stakes processing. You need strict legal conditions—not a casual loss-prevention plugin.
Full Explanation
A retail shop using facial recognition to match customers against a shoplifter watchlist is best characterised as biometric facial recognition for identification that typically involves special-category data and high-risk processing needing strict conditions and strong justification. Face-matching shoppers is not a casual guestbook upgrade; it is systematic biometric identification in a public-facing commercial space. Treating facial templates as ordinary contact data with guestbook-level risk fails Article 9 seriousness. Claiming watchlist matching is always exempt as purely household processing by the shop owner fails—commercial shop surveillance is not household activity. Saying customer biometrics for identification are low risk if camera resolution is high fails—higher fidelity often increases identification risk. Exam caveat: processing biometric data for unique identification requires an Article 9 condition as well as an Article 6 basis, plus necessity, proportionality, and usually a DPIA; many deployments cannot meet that bar. Operational check: halt unjustified face-watchlist matching, explore less intrusive loss-prevention measures, if pursued complete DPIA and Article 9 analysis with strong TOMs, and expect heightened SA scrutiny.