Parliamentary Search

Written question asked by Lord Taylor of Warwick (Non-affiliated) on Monday, 28 February 2022, in the House of Lords. It was due for an answer on Monday, 14 March 2022. It was answered by Lord Parkinson of Whitley Bay (Conservative) on Monday, 14 March 2022 on behalf of the Department for Digital, Culture, Media and Sport.

Companies: Surveillance

Question

To ask Her Majesty's Government what steps they are taking to regulate companies' use of technological systems to monitor people.

Answer

Organisations that process personal data for the purposes of monitoring their activities or surveillance must comply with the requirements of the UK General Data Protection Regulation and the Data Protection Act 2018. This means that the data processing must be fair, lawful and transparent. Any adverse impact of monitoring on individuals must be necessary, proportionate and justified by the benefits to the organisation and others. A Data Protection Impact Assessment (DPIA) would usually be required, particularly where the processing involves the use of new technologies, or the novel application of existing technologies.

Where people’s biometric data are processed, such as through fingerprint, voice or facial recognition technology, companies would generally need to conduct a DPIA. Companies conducting live facial recognition would generally need to show that processing was necessary for one of a limited number of specified reasons of substantial public interest - for instance, preventing or detecting unlawful acts. They would also need to show that specific conditions and safeguards were met.

The Information Commissioner’s Office is the UK’s independent regulator for data protection and has published extensive guidance to help organisations comply with their data protection obligations. This includes guidance for employers on the rules in relation to monitoring of employees, as well as guidance on monitoring employees in connection with Covid-19 related measures.

The Information Commissioner has also published an opinion on the non-law enforcement use of live facial recognition technology in public spaces which explain the requirements of the legislation and stress that data protection and people’s privacy must be at the heart of any decisions to deploy live facial recognition technology in public spaces.

Secondary information

Type
Written question
Reference
HL6516
Session
2021-22
Subjects
Companies Surveillance Regulation Technology
Link
View this Written question on www.parliament.uk