I hate the idea of ubiquitous facial recognition spying on me everywhere but I also love the idea of some AR future where my wearable AR contact lenses project into people's names and other info next them them at a meetup or party or other social gathering.

If nothing else I'd like it to be able to remember the faces of people I personally meet (so I don't need to share their data but I do need it saved in my device). I don't see how that would be compatible with data privacy laws regarding facial recognition though.

I tend to like this idea as well, but struggle with how to make it privacy conscious in a way that satisfies everyone.

As an example, I toss around with the idea of "localized recognition" a la I upload a contact and his/her photo, and therefore my AR tool can recognize the contact image using ML, but it's not uploaded to any central server in any meaningful way (outside of maybe certain metadata to update the underlying ML models.) But even then, some might find that creepy...

I'm not sure I understand your comment. How would you _not_ retain data/metadata information about recognition and still provide any utility?

Wouldn't the analogy be like Facebook identifying your face in photos, but not retaining the fact that you're in the photo?

It depends on the use case. Example: I walk through the airport and an application scans my face and either calls security because I was recognized as a known terrorist or let's me pass because I'm awesome. The parent's point matters for what happens after. In the not a terrorist case the problematic system would retain that (it thinks) you walked through the airport. In a even more problematic system you now get ads because you were there.

Wait - wouldn't you _want_ the system to retain that information in your first case if you were mis-identified as a terrorist? I.e. you were recognized, but you were confirmed not a terrorist - so you won't be flagged later. Or maybe I misunderstood.

Otherwise, you run the risk of not updating the model to fix the false positive, and you might be flagged multiple times in the future.

I wouldn't want the system to keep information about me having been anywhere unless I'm a criminal. How would that information be helpful in updating the model. It already worked correctly.

Interacting with a system can take years. That's okay for privacy if the person is informed and has control, e.g. can request full deletion anytime.

I have a very little bit of experience here but I have a few questions based on your solution.

What value does a recognition have? Is it just metadata they can act on in the moment? AKA age, height, race, gender? Are you ok with them knowing it is you by name or a assigning some UID to you as a person and keeping metadata? What about a hash of your facial pattern? How do they know if they've seen you before?

To a lot of FR programs they want to be able to analyze their customer breakdown. They want to know more than just crowd information. Given that we regulate the storage of medical information so highly right now, and you can infer based on purchase practices whether an individual has certain medical issues, I can see regulation being needed. But it raises a lot of questions about how to realistically regulate a system like this.

I'm by no means saying "don't regulate." but we need to be thoughtful about how we proceed so that regulations have few loopholes and protect citizens from both corporations leaking data and the government tracking individuals needlessly.

The problem for me is feature creep. Someone may create a facial recognition database for worthy reasons, but once that database is created it doesn't take a lot to allow the usage criteria to change.

In Ireland the government is obsessed with issuing everyone with a "voluntary" Public Services Card, the photo on it being biometric. Officially it is voluntary, but you need one to get many public services, including getting a driving licence or passport - so not really voluntary.

The system has been used to catch a handful of benefits cheats - single numbers - so naturally the government hails it as a major fraud fighting tool.

Now catching benefit fraud is worthy, but where do you stop? You may think the GDPR protects the system from abuse, but that counts for nothing where the authorities pull the crime prevention and detection card. The protections provided by the GDPR can be cancelled out by a court order if Gardai claims it will solve/prevent a crime.

And once that has happened a few times it will start to become normalised and eventually abused. E.G. Applying for a civil service job and being turned down for going on an anti-government rally ten years ago.

If you create something that can be abused, it probably will be abused.