Principles for facial recognition technology: A content analysis of ethical guidance in the United States

2.1 Defining artificial intelligence and facial recognition technology

There is currently no common consensus on how to define AI, and while some definitions focus on popular technical approaches such as machine learning and the methods by which they are developed, many are broad [20, 21]. At the broadest possible understanding of the term, AI is the ability of a machine to mimic a human’s behavior or capability [21–23].

FRT typically refers to systems that use facial images for the purpose of person identification or verification; however, much of the same core technology can also be used to detect a face (without necessarily relating it back to an individual) or to extract information from facial images such as emotional expression [13, 25]. The capabilities are interrelated because it is typically necessary to perform the first phases of detecting a face and relevant features from an image before performing tasks such as facial analysis [24, 26]. While there is a valid argument that more simplistic FRT systems are not AI systems, under the broadest definition of AI, even simplistic methods could be considered as replicating a human’s ability to recognize an individual or attributes of a person’s face. However, this debate is mostly irrelevant now because while early FRT methods were simplistic in nature, many modern FRT systems leverage widely agreed AI techniques such as convolutional neural networks [22, 27].

2.2 Ethical issues and potential solutions

Ethical issues in AI and FRT are overlapping, which is not surprising given the close relationship in how these technology areas are defined. While the potential ethical issues in these technology areas can drive significant attention, the adoption of these technologies would not be occurring at such a rapid rate if they were not also providing significant benefits. Some of these benefits of AI and FRT include the potential usefulness, efficiency, sustainability, safety, impartiality, non-intrusiveness, cost savings, and economic opportunity associated with these systems [24, 28–30]. AI and FRT technologies were beneficial during the COVID-19 pandemic, but also fueled an environment where ethical considerations are critical [1, 2]. The counter measures taken by governments to limit the spread of the disease had a significant influence on the daily habits of individuals, including on dietary habits and the diversity of foods that individuals consumed [31]. Organizations also had to adapt to the COVID-19 pandemic. For example, many academic institutions and their student populations embraced online library services as social norms and attitudes changed [32]. Many private sector organizations adapted to the new realities of COVID-19 by adjusting their strategies and increasing innovation to survive during a period of supply chain disruption and increased competition within the marketplace [33]. Some businesses benefited from this new reality. For example, increased competition has had a positive effect on financial performance measures of businesses in China [5]. However, increased online activity and the associated data can fuel ethical concerns.

Privacy is considered a universal human right, and organizations frequently highlight the notion that FRT should not infringe upon this right [47]. The theme of privacy was, in fact, identified in 100% of the documents and was, therefore, amongst the most prevalent themes identified. A common recommendation was that privacy should be protected and data should be secured, especially in high-risk contexts where there is a reasonable expectation of individual privacy. Documents often pointed to the United States Constitution’s Fourth Amendment; for example, Geraghty [48 p14] stated in the National League of Cities (NLC) document that “the Fourth Amendment protects people from unlawful police searches where they have a reasonable expectation of privacy.” The documents also highlighted how privacy remains a focus despite potentially competing priorities; for example, SAFR [49 para1] stated that while education leaders are concerned about safety, they are also “equally vigilant about protecting the privacy of staff, students, and visitors at the schools.”

5.2 Responsibility

Recommendations relating to the concept of responsibility were identified in 100% of the documents. A common recommendation was that organizations take steps to ensure both the responsible creation and implementation of FRT. For example, the United States Chamber of Commerce Chamber Technology Engagement Center [50 p1] highlighted businesses “have a responsibility to ensure the safe development and deployment of facial recognition technology.” The documents also highlighted that responsibility extends beyond the scope of the technology system itself and must also factor in broader organizational policy and guidance. For example, the Integrated Justice Information Systems Institute and the International Association of Chiefs of Police and Law Enforcement Imaging Technology Task Force [51] recommended required training before using the technology in a law enforcement context. Further, FBI director Kimberly J. Del Greco testified that agencies should “ensure that comprehensive policies are developed, adopted, and implemented in order to guide the entity and its personnel in the day-to-day access and use of facial recognition technology” [52 para25].

5.3 Accuracy and performance

Accuracy and performance recommendations within the documents frequently related to measuring and enabling these aspects in FRT, including ensuring adequate quality in associated data. The accuracy and performance theme was identified in 92% of the documents. It is likely that many of these recommendations were influenced by NIST’s “Face recognition vendor test (FRVT) Part 3: Demographic effects” report which called attention to the fact that there can be a reduced risk of differences in error rates across demographic groups when algorithms with the highest overall accuracy rates are used [12, 53]. The United States Government Accountability Office [13] document had “accuracy” in its title and, in addition to privacy, was a primary theme within that document. World Economic Forum [54 p9] puts a heavy focus on performance, highlighting it as a key principle and recommending that organizations evaluate the “accuracy and performance of their systems at the design (lab tests) and deployment (field tests) stages.” West [55 para12] recommended in the Brookings document that there be mandated standards relating to accuracy but acknowledged that it could be a challenge to “determine how high accuracy levels should be before FR is deployed in a widespread basis.” Achieving maximum levels of accuracy and performance can be challenging, given that it is not just one-time consideration. Greene [53 para24] pointed out in the ImageWare document that algorithms will need to be upgraded “as new and improved algorithms are developed (which is constant!).”

5.4 Accountability

Accountability was a theme found in 88% of the documents. These documents commonly referenced a need for accountability mechanisms to help ensure the responsible creation and implementation of FRT. For example, the Future of Privacy Forum (FPF) included accountability as one of the core principles within their document, noting that it may involve parties outside of the organization itself when recommending “reasonable steps to ensure that the use of facial recognition technology and data by the organization, and in partnership with all third-party service providers or business partners, adheres to these principles” [57 p11]. Accountability also appeared as a strong theme in organizations that drew from the existing FIPPs framework, which is not surprising given that the FIPPs include accountability as a core principle [13, 57–59]. The documents highlighted the importance of regulation in enabling accountability; however, it was also clear that there are several other types of accountability mechanisms that organizations should also be considered. For example, Facial Identification Scientific Working Group [59 p1] recommended that individuals who violate their ethical principles for facial identification practitioners “be reported to the FISWG executive board.” Individual accountability can be important for “developers, operators, and users” of FRT systems [60 p4].

5.5 Transparency

Recommendations for transparency, found in 84% of the documents, often focused on the importance of being transparent both about the use and capabilities of FRT systems. For example, Algorithmic Justice League and Center on Technology and Privacy at Georgetown Law [61] included the facilitation of transparency as one of the four primary organizational commitments outlined within the document. Transparency also appeared as a major category of recommendations within the American Legislative Exchange Council [62], Future of Privacy Forum [56], United States Department of Commerce National Telecommunications and Information Administration [63], SAFR [49], and Security Industry Association [58] documents. The American Legislative Exchange Council [62 para20] highlighted how transparency is fundamental, with the declaration that “transparency is the bedrock that governs the use of facial recognition technology.” Examples of recommended transparency practices included making “available to consumers, in a reasonable manner and location, policies or disclosures” [63 p1], documenting and communicating “the capabilities and limitations of facial recognition technology” [64 p1], and making performance assessments “auditable by competent third-party organizations and their reports made available to users of the systems” [64 p9].

5.6 Lawful use

Taking steps to ensure the lawful use of FRT was a common recommendation within the documents, a theme found within 84% of the documents. For instance, Microsoft Corporation [63 p3] named “lawful surveillance” as a core principle for FRT. World Economic Forum [53 p8] included a pointed recommendation that organizations who attempt to pilot their principles “be lawful.” Similarly, American Legislative Exchange Council [62 para3] recommended that “policymakers should ensure that government entities, especially law enforcement, only use facial recognition for legitimate, lawful and well-defined purposes.” The general calls for lawful use were frequently tied to concerns over the possible infringement of basic human liberties and rights, and the specific recommendations for ensuring appropriate policies, terms, and legal documentation were aimed at reducing the risk of unlawful use.

5.7 Fairness

Fairness recommendations, found within 80% of the documents, commonly highlighted that organizations should take appropriate steps to enable fairness when creating and implementing FRT. A typical sentiment can be found in Google’s statement that FRT “needs to be fair, so it doesn’t reinforce or amplify existing biases, especially where this might impact underrepresented groups” [65 para4]. A similar sentiment can be found in the Avanade document, which highlighted the importance of ensuring FRT be “fair and inclusive” [68 para4]. The documents frequently identified the risk of unfairness as a key concern, often driven by underlying issues such as a lack of representative data sets used by FRT systems [13, 66–69]. Taking steps to ensure fairness is particularly important in high-risk contexts such as law enforcement, and as Goldman [70 para4] warned within the Salesforce document, “the use of facial recognition in public spaces can create opportunities for political manipulation, discrimination, and more” and that the “risks to transgender, nonbinary, or gender non-conforming individuals are also acute.”

5.8 Purpose limitation

Purpose limitation of both the FRT system and associated data were common recommendations within the documents, a theme identified within 72% of the documents. The potential risk and expectations of stakeholders were highlighted as key considerations when determining how the purpose of the system and data should be limited. These considerations clearly draw from data privacy concepts on purpose limitation but expand upon this concept to also consider how the system’s use case should be limited. The relationship between the data and the system’s use case is inextricably tied, given that expanding the use case beyond how it was originally intended to be used may also result in data that is used beyond its originally intended purpose or may even result in new data.

As stated by Geraghty [48 p33] in the NLC document, in the context of law enforcement, there should be limits on the “scope of facial recognition use to reduce the risk of misidentifications and privacy violations.” Montgomery and Hagemann [64 p2] also highlighted certain use cases as a concern within the IBM document, where it was stated that there are some “clear use cases that must be off-limits” and “mass surveillance” and “racial profiling” were offered as examples. Similar sentiments were echoed in other documents as well, which highlighted the importance of requiring limitations in the use of FRT in surveillance contexts and in body-worn camera use cases [48, 68]. Within the Gartner document, Sakpal [71 para8] pointed out the importance of ethical proportionality in the context of facial recommendation technology, “it means that an organization should use technology powerful enough to solve a particular problem, but not much more powerful.”

6.1 Comparison by organizational type

A comparison between the ethical recommendations made by private sector, government, and civil society organizations also revealed some uniqueness. Differences are likely due to multiple factors, including diversity. Documents from private sector organizations contained fewer recommendations for transparency (78% of documents), accountability (67%), and purpose limitation (44%) compared to government and civil society groups. Documents from government organizations had fewer recommendations for lawful use (60%) and fairness (40%). Documents from civil society groups had greater than 90% of documents that contained recommendations from each of the themes identified in this study. A review of the members who participate in the civil society groups reveals that these groups tend to have a great deal of diversity. This diversity in membership may contribute to the consistency across all recommendation categories, given the breadth of perspectives that contributed to them.

6.2 Discussion on the impact of COVID-19

The COVID-19 pandemic created scenarios where increased focus on FRT ethics is needed, given its impact on the global supply chain and organizations across many industries [72]. For example, in the COVID-19 context, online social media platforms have helped organizations disseminate information; therefore, increased use of these platforms can be beneficial [73]. However, it is ethical, and possibly legally required, to limit the use of the facial image data created in online social media platforms to their intended purpose. Furthermore, in this context it is ethical to deploy systems that are accurate and perform well for their task, as well as to offer alternatives that do not require the use of face data. For example, screening potential COVID-19 patients over the telephone [74].

7.1 Limitations

This study is not without limitations. The timeframe for data collection of guidance documents was limited to documents produced between January 2016 and June 2021, and additional guidance documents that might meet the inclusion criteria published after June 2021 were not included. Documents that were produced outside of the geographic scope were also not included, and this could impact the generalizability of the findings. Documents as data sources also have the potential to be incomplete or inaccurate [75]. Finally, researcher bias is possible where the researcher is the primary instrument for data collection [75–77]. Steps to mitigate these limitations were addressed through documentation of procedures, triangulating against multiple data sources, and involving subject matter experts for review [75, 77–80]. However, future research is required to fully address these limitations and confirm the generalizability of the findings.

7.2 Concluding remarks and future directions

Using a qualitative content analysis research methodology, eight common themes were identified across 25 documents produced by government, private sector, and civil society organizations. The resulting themes, which are also principles for FRT, include privacy, responsibility, accuracy and performance, accountability, transparency, lawful use, fairness, and purpose limitation. This study is significant because it helps fill a current gap in the body of knowledge on themes in ethical guidance documents for FRT, presenting a novel view of the convergent principles to which they are aligned. The results can be leveraged by organizations. For example, if an organization identifies a need to increase their focus on transparency, they may choose to adopt practices identified in subcategory themes such as sharing information on the organization’s use of FRT and current policies and engaging with stakeholders to gather feedback. The results may also help inform policymakers as they develop policies and regulations, those developing industry standards, and other stakeholders within the industry who are looking to help develop common ethical norms that support the best interest of society. For example, policymakers who aim to regulate FRT such that citizens are maximally protected from potential harm can review draft regulations against the results of this study to confirm that common recommendations are fully addressed. Other stakeholders, such as those from industry associations or advocacy groups, may also find the results of this study inform their understanding of existing common recommendations and how their views may relate to those of other organizations, which can help them develop a robust point of view.

Future research on FRT ethical guidance documents produced by organizations in other geographic regions of the world and at the global level would be beneficial. Given the differences observed in recommendations between government, private sector, and civil society groups, it would also be useful to explore why these differences occur and the implications of the root causes. Evaluating how these principles are implemented within organizations would also be useful to identify their effectiveness in practice. This evaluation could help determine if and how the principles guide FRT’s ethical development, deployment, and use. For example, a study focused on notice and consent practices could help determine their effectiveness when used by organizations to help put the transparency principle into practice. It could also lead to identifying strategies that can improve their effectiveness in achieving the desired level of transparency. Research investment was found to be a subcategory theme within the ethical guidance documents studied, and the researchers involved in this study echo this call for prioritizing research that helps enable alignment with ethical principles for FRT systems.