The ICO’s new Framework – the two-paced pitch
The second in a short series on the ICO’s new Complaints Framework: this one for anyone deploying facial recognition or biometrics, particularly in the Gambling Sector.
Still running with the cricketing analogy for people like Benjamin Chilcott and my learned friend and Kent cricket aficionado Dean Armstrong KC.
A quick recap for those who missed the first post. Since February, the ICO has been triaging out around one data-protection complaint in every two before an investigator so much as looks up. The half that survives is not random: it favours complaints involving serious harm, vulnerable people, or the ICO’s stated priorities — chief among them AI and biometrics. If biometrics is your business, the average is not your friend.
Facial recognition for self-exclusion sits on a two-paced pitch — the kind where one ball keeps low and the next flies off a length, and a batter is never quite set. The danger runs in both directions at once.
Be unprepared and you get the Portsmouth problem. When a BBC reporter self-excluded across the Adult Gaming Centres around Portsmouth last year, he was turned away at one and walked into thirteen others. A self-exclusion scheme that fails to exclude is the delivery that shoots along the ground — it takes the wicket of the very people the scheme exists to protect, and those people are, by definition, vulnerable.
Try to play too agressively and you get the mirror image. A false match, or the quiet retention of the faceprints of people who were never excluded, is the ball that rears off a length — a high harm privacy failure involving special category data, and precisely the sort of thing the ICO has said it is looking for.
It is the pitch, not the bowler, doing the damage — and it cuts both ways. For an operator, that means a complaint about your technology need not be exceptional to be investigated; it need only land on one of those two lengths.
The way to bat on a two-paced pitch is not to swing wildly, but to play straight and know your conditions: a live DPIA, a clear lawful basis and Article 9 condition, documented accuracy and bias testing, ruthless minimisation of the images you keep, and an internal complaints procedure that settles grievances before they carry to Wilmslow.
If you are batting on this surface, it is worth knowing which way the ball is likely to move before it does.