Facial recognition in the workplace: is it lawful?

Employers and facial recognition: the legal position in the United Kingdom. Facial recognition technology is increasingly considered by employers for access control, time and attendance systems, and workplace security. Its use is not prohibited as such. However, because it involves biometric identification, it engages some of the most stringent requirements in data protection and employment law.

This article is intended for general information only. It is not, and must not be treated as, legal advice. The lawfulness of any particular arrangement depends upon its precise facts.

Biometric data and data protection law

Where an employer uses facial recognition to identify an individual, it is processing “biometric data” for the purpose of uniquely identifying a person. Under the UK GDPR and the Data Protection Act 2018, that constitutes “special category” data. Processing such data requires both a lawful basis (for example, legitimate interests or compliance with a legal obligation) and a separate condition permitting the processing of special category data.

In practice, reliance on employee consent is frequently problematic. Consent must be freely given, specific, informed and unambiguous. Given the inherent imbalance of power in employment relationships, regulators have consistently indicated that consent will rarely be valid where refusal may carry adverse consequences.

The decisive issue is usually necessity. An employer must be able to demonstrate that the use of facial recognition is necessary for a legitimate aim and that the same objective cannot reasonably be achieved by less intrusive means. Convenience, administrative efficiency, or technological novelty will not suffice.

For example, where the stated aim is to control access to secure premises, the employer will be expected to consider whether key cards, PIN codes, or staffed entry points would achieve the same objective with less impact on employees’ privacy. The more invasive or continuous the monitoring, the stronger the justification required.

The Information Commissioner’s Office expects employers to conduct a Data Protection Impact Assessment before introducing high-risk technologies such as facial recognition. A DPIA should identify the risks to employees’ rights and freedoms, evaluate alternative measures, and set out safeguards. Failure to undertake a proper assessment may itself amount to non-compliance.

Employers must be transparent about what data is collected (for example, a facial template rather than an image), the purpose of the processing, retention periods, access controls, and employees’ rights. Covert deployment will attract particular scrutiny and may, in addition to regulatory risk, undermine the implied duty of mutual trust and confidence in employment contracts.

Biometric identifiers require heightened security. Appropriate technical and organisational measures must be in place to prevent unauthorised access or misuse. Retention must be limited to what is strictly necessary; indefinite storage is unlikely to be defensible.

Equality considerations

Accuracy and bias are material legal concerns. If a system demonstrates differential error rates across protected groups, employers may face risk under the Equality Act 2010. Employers in the public sector must also have due regard to the public sector equality duty when introducing such systems.

Employers may lawfully use facial recognition in certain circumstances. However, because the technology involves sensitive biometric identification, its use demands rigorous justification, careful assessment, and robust safeguards. In many ordinary workplace settings, employers will need to demonstrate clearly why less intrusive alternatives are insufficient.

This article provides general information only and does not constitute legal advice. Specific advice should be sought in relation to individual circumstances.

If you have a legal issue and need specific advice contact us to arrange a free case analysis.