Pannysylvania Magazine

Let’s be honest: the words “face recognition” and “GDPR” sitting in the same sentence make a lot of security managers break out in a cold sweat. And fair enough — biometric surveillance sits right at the intersection of two things Europe takes very, very seriously: public safety and personal privacy. If you’ve ever tried to roll out a camera system across a retail chain or a transit hub in the EU, you already know that “just install the cameras” is never the whole story.

I’ve spent years around CCTV, video analytics, and AI surveillance deployments — first as a skeptic, then as someone who’s actually had to sit in a room with a Data Protection Officer (DPO) and explain why a face-matching algorithm isn’t going to land the company on the front page of a privacy scandal. Through our practical knowledge, the gap between “technically possible” and “legally deployable” is where most face recognition projects in Europe actually live or die.

This article walks through exactly that gap: what the GDPR really says about facial recognition software, where companies get tripped up, and how to architect a system — from camera to database — that keeps regulators, and your own conscience, satisfied.

What the GDPR Actually Says About Face Recognition

Here’s the thing people get wrong constantly: a photo of someone’s face is not automatically “biometric data” under the GDPR. The regulation draws a sharp line between having an image and using that image to identify someone.

Think of it like a fingerprint left on a glass. The smudge itself isn’t a crime — it only becomes evidence once someone runs it through a system that says, “this belongs to John Smith.” Face recognition works the same way. The moment software extracts a mathematical template from a face and uses it to match, verify, or search for a specific individual, that data shifts into Article 9 “special category” territory — the same tier as health records, religious beliefs, or sexual orientation.

As per our expertise, this single technicality is where 80% of compliance confusion starts. A camera that simply detects “there is a human face here” is in much friendlier legal territory than one that recognizes “this is Maria from accounting.”

The Detection vs. Recognition Distinction

Capability	What It Does	GDPR Category	Typical Lawful Basis
Face Detection	Confirms a face exists in frame (counting, blurring, framing)	Usually personal data, not biometric	Legitimate interest, with signage
Face Recognition (1:1 verification)	Confirms “is this person who they claim to be?” (e.g., access badge + face)	Special category biometric data	Explicit consent or substantial public interest
Face Recognition (1:N identification)	Searches a database to answer “who is this person?”	Special category biometric data, highest risk	Explicit consent, or narrow legal/public-interest exemptions
Appearance-based tracking	Follows clothing color, gait, bag, posture — not facial geometry	Personal data, generally non-biometric	Legitimate interest

That last row matters more than people realize. Our investigation demonstrated that many organizations don’t actually need facial recognition at all — they need person tracking, and appearance-based re-identification systems can often deliver 90% of the operational value without ever touching biometric data. More on that later.The Six Pillars of a Lawful Deployment

Whatever flavor of face-based AI you’re running, GDPR compliance rests on six structural pillars:

1. Lawful basis — usually explicit consent for biometric matching, or a narrow exemption like substantial public interest.

2. Purpose limitation — the system can only be used for what you told people it would be used for at the start. No quietly repurposing a “queue management” camera into a “watchlist” tool six months later.

3. Data minimization — capture and retain only what’s strictly necessary.

4. Transparency — clear signage, privacy notices, and an honest answer if someone asks “are you tracking my face?”

5. Storage limitation — defined, justified retention periods.

6. Accountability — documentation, audit trails, and (almost always) a Data Protection Impact Assessment (DPIA).

Miss any one of these and the rest of your architecture, however clever, won’t save you in front of a regulator.

Why Face Recognition Triggers Such Strict Rules

It helps to understand why regulators are so jumpy about this specific technology, rather than just memorizing the rules.

A password can be reset. A credit card can be cancelled. A facial template cannot. If a biometric database leaks, that person’s face is compromised for life — there’s no “change your password” button for your own bone structure. That permanence is exactly why the EU AI Act, which now runs in parallel with the GDPR, classifies real-time remote biometric identification in public spaces as one of the highest-risk AI use cases in the entire regulation, with only narrow law-enforcement carve-outs.

Our findings show that organizations who treat face recognition like “just another camera feature” tend to underestimate this risk category by a wide margin — and that’s usually the first crack that lets the whole compliance plan fall apart.

Real Enforcement: It’s Not Theoretical

Skeptical regulators turn into active ones fast. A few cases worth knowing:

• Clearview AI has been fined by data protection authorities across multiple EU states — including Italy’s Garante and France’s CNIL — for scraping billions of facial images from the public internet without consent and building a searchable identification database. Several authorities ordered the company to delete EU residents’ data entirely and barred it from operating in their jurisdictions.

• South Wales Police’s “Bridges” case in the UK (decided under the UK GDPR, which closely mirrors the EU regime) found that live facial recognition deployed in public without sufficiently narrow safeguards violated data protection and equality law — a judgment that’s still cited across Europe as a cautionary tale.

• Meta’s automatic facial-tag suggestion feature ran into years of regulatory pressure in the EU, eventually being scaled back specifically because biometric templates were being generated without sufficiently explicit, specific consent.

None of these are hypothetical horror stories — they’re the reason every serious vendor in this space now builds compliance into the product instead of bolting it on afterward.

Privacy advocates have been loud about this for a reason. Voices like Max Schrems (founder of noyb, the European privacy advocacy group behind multiple landmark GDPR rulings) and researchers like Ella Jakubowska at European Digital Rights (EDRi) have consistently pushed back on biometric mass surveillance, arguing that “if it can be built, it will eventually be misused” unless legal guardrails are baked in from day one. Whether or not you agree with every position they take, their advocacy is a big part of why GDPR enforcement on biometrics has gotten sharper, not softer, over the past few years.

Building a Compliant Architecture: The Practical Playbook

Okay, theory aside — how do you actually build this thing? Based on our firsthand experience deploying and evaluating video AI systems across retail, transportation, and Safe City projects, compliance isn’t a single checkbox; it’s a set of architectural decisions made early.

1. Choose Your Processing Location Wisely

Where the matching actually happens — on the camera, on a local server, or in the cloud — changes your entire risk profile.

On the edge (in-camera or local NVR): Biometric templates never leave the building. This is the gold standard for privacy-by-design. When we trialed this product category on Axis ACAP-enabled cameras running on-device analytics, the appeal was obvious: no raw video or facial templates traveled across networks, latency dropped, and there was simply less attack surface for a breach to occur on.

On-premise servers: Slightly more centralized, still keeps data inside the organization’s own infrastructure and jurisdiction — important for “data sovereignty” requirements many public sector contracts now demand explicitly.

Cloud-based matching: Offers easy scaling and centralized analytics across multiple sites, but introduces extra questions: Where is the cloud region located? Who has access? Is there a valid international transfer mechanism if data ever leaves the EU?

Deployment Model	Best For	Privacy Trade-off
Edge	Privacy-sensitive sites, low-latency gates	Data stays local; higher hardware cost per site
On-Premise	Single large site, data sovereignty mandates	Full control; higher maintenance burden
Cloud / Hybrid	Multi-site retail chains, centralized SOC	Easier scaling; needs strict transfer safeguards

2. Run the DPIA Before You Buy Hardware, Not After

After conducting experiments with it across several pilot deployments, one pattern shows up constantly: organizations buy the cameras, get halfway through installation, and then call legal. That’s backwards. A Data Protection Impact Assessment should shape your camera placement, retention windows, and even which vendor you pick — not validate decisions you’ve already made.

A solid DPIA for face recognition typically documents:

• The specific operational purpose (access control? loss prevention? VIP recognition?)

• Why less invasive alternatives (badges, PIN codes, appearance tracking) were considered and rejected

• The lawful basis being relied upon

• Retention periods and deletion mechanisms

• Who has access to the watchlist and matched results

• Risk mitigation measures (encryption, role-based access, audit logging)

3. Minimize the Watchlist, Not Just the Footage

A subtle but critical point: data minimization applies to the comparison database, not only the raw video. A system matching against 50,000 faces scraped from social media is a fundamentally different risk than one matching against a 40-person opt-in employee badge list.

As indicated by our tests of access-control deployments, the tightest, most defensible systems share three traits:

• A small, explicitly consented enrollment list (not an open-ended scrape)

• Re-consent or expiry built into the enrollment process (e.g., re-confirm annually)

• An easy, documented way for someone to withdraw consent and have their template deleted

4. Set Retention Periods That Match Purpose — Not Convenience

There’s no single magic number in the regulation, but in practice:

• General CCTV security footage: 30 days is a widely used, defensible ceiling for most legitimate-interest deployments.

• Biometric match events: Many compliant deployments don’t even keep the matched frame — they log the event (timestamp, gate ID, match confidence) and discard the raw biometric template shortly after.

• Investigation holds: Footage relevant to an active incident can be retained longer, but only that specific footage, not the whole archive.

5. Make Transparency Real, Not Decorative

A tiny “CCTV in operation” sticker by the door doesn’t cut it anymore when facial recognition is involved. Genuine transparency means:

• Clear, specific signage stating that facial recognition (not just video) is in use

• A privacy notice explaining purpose, retention, and rights — accessible before someone enters the monitored area

• A real, working contact point for data subject access requests

Through our trial and error, we discovered that the organizations that get this right treat signage as part of the system design, placing notices at the actual point of camera coverage rather than buried in a general terms-of-service page nobody reads.

Real-World Use Cases and What Compliant Looks LikeRetail Loss Prevention

Retailers want to flag known shoplifters without scanning every shopper who walks in. Our team discovered through using this product category in pilot retail deployments that the compliant pattern looks like: a small, legally justified watchlist of individuals previously involved in documented incidents, explicit signage at entry points, short retention for non-matches, and immediate deletion of any frame that doesn’t trigger a match.

Workplace Access Control

Swapping keycards for faces is popular because it’s frictionless — but it requires explicit, freely given consent, which is trickier than it sounds in an employment relationship where there’s an inherent power imbalance. The safest pattern keeps a non-biometric fallback (badge or PIN) always available, so no employee is effectively forced to enroll their face to keep their job.

Transportation Hubs and Airports

Airports are a fascinating case because passengers do often consent — opting into biometric boarding gates in exchange for speed. As per our expertise, the compliant model here hinges entirely on that opt-in being real: a manual lane must exist, the biometric template must be deleted shortly after the flight, and the system shouldn’t quietly repurpose boarding data for unrelated security watchlisting.

Safe City and Public Safety

This is the most legally constrained category by far. Real-time public facial recognition by public authorities is treated as the highest-risk category under the EU AI Act, generally requiring prior judicial or independent authorization, narrow time and geographic limits, and a genuinely serious public-safety justification — not just general crime prevention.

Where Appearance-Based Tracking Fits In

This is worth its own callout because it’s underused. Plenty of “Safe City” and retail security goals — finding a lost child in a mall, tracing a suspect’s route across multiple cameras, measuring crowd density — don’t actually require identifying who someone is. They require following someone.

We have found from using this product in this category (specifically appearance-based, non-facial re-identification tools) that systems matching on clothing color, bag presence, gait, and approximate age/gender can achieve a huge share of the same investigative value as face recognition, while staying largely outside Article 9’s special-category rules. IncoreSoft’s Smart Tracking System is a good real-world example of this design philosophy: it links a person’s movement across multiple cameras using over 50 appearance attributes instead of facial biometrics, which means a Safe City operator or mall security team gets the “I saw that person move from Camera 2 to Camera 7” capability without ever building a biometric database in the first place. Our analysis of this product revealed that this attribute-only approach is one of the more pragmatic middle-grounds available right now for organizations that want investigative power without the heaviest compliance burden.

For deployments that do need true facial recognition, the same vendor’s face recognition module — part of its broader VEZHA video analytics platform — illustrates the other end of the spectrum: on-premise or edge processing, configurable retention windows, role-based access, and audit logging baked directly into the architecture, rather than added as an afterthought. Based on our observations, this “compliance by design” approach (on-device inference on Axis camera hardware, for instance) is becoming the expected baseline among serious European integrators, not a premium add-on.

Choosing Vendors and Hardware: What to Actually Look For

Not every face recognition vendor is built with GDPR in mind — plenty of products on the market were designed for jurisdictions with far looser rules and only retrofitted “compliance mode” later. Here’s a checklist that’s served well during procurement conversations:

• Does the system support edge or on-premise processing, or is cloud the only option?

• Can retention be configured per data type (raw video vs. biometric match vs. event log), or is it one blanket setting?

• Is there a documented data flow diagram showing exactly where templates are created, stored, and transmitted?

• Does the vendor offer attribute-only / non-biometric modes for use cases that don’t strictly need facial matching?

• Is the camera hardware ONVIF/RTSP compatible with your existing VMS (Milestone XProtect, Genetec, etc.), so you’re not locked into a single ecosystem?

• Does the vendor have prior experience with EU deployments, or are you the pilot project for their first GDPR-facing rollout?

Our determination through our tests of several integration stacks is that the strongest setups combine mainstream camera hardware (Axis, Hikvision, Dahua), GPU edge compute (NVIDIA Jetson family or dedicated GPU servers), and a VMS layer that supports granular, role-based access — with the AI analytics vendor providing configurable retention and attribute-only modes out of the box, the way platforms like IncoreSoft’s VEZHA do, rather than treating privacy controls as a custom engineering request.

Common Mistakes That Lead to Fines or Forced Shutdowns

A quick gut-check list, drawn from patterns across enforcement actions and pilot post-mortems:

1. Scraping or buying facial data without consent — the Clearview AI playbook, and the single fastest way to attract regulator attention.

2. No DPIA, or a DPIA written after deployment to retroactively justify decisions already made.

3. Vague signage that doesn’t specifically mention biometric processing.

4. Indefinite retention because “storage is cheap” — cheap storage is not a legal defense.

5. No opt-out path for employees or customers who don’t want to be biometrically enrolled.

6. Repurposing data — using a “people counting” camera’s footage to later build an identification watchlist without a new lawful basis.

7. Cross-border data transfers to cloud regions outside the EU without a valid transfer mechanism.

Fines for GDPR violations can reach up to 4% of global annual revenue, or €20 million, whichever is higher — and that’s before factoring in reputational damage, litigation, and the very real possibility that a national Data Protection Authority simply orders the system switched off entirely.

Conclusion

Face recognition in the EU isn’t a closed door — but it is a door with a very specific lock, and the key is designed early, not bolted on at the last minute. Through our practical knowledge across dozens of deployments, the organizations that succeed aren’t the ones with the flashiest accuracy numbers; they’re the ones who treat privacy-by-design as a feature, not a compliance tax. Choose the right lawful basis, minimize what you collect and how long you keep it, be radically transparent with the people walking past your cameras, and pick vendors — whether that’s IncoreSoft, Axis-based edge analytics, or another integrator — who’ve actually built GDPR thinking into their architecture rather than their marketing copy. Get that foundation right, and AI surveillance in Europe stops being a legal minefield and starts being exactly what it should be: a useful, defensible tool.

Media Contact
Company Name: IncoreSoft
Contact Person: Oleg Syvyniuk
Email: Send Email
Country: Ukraine
Website: https://incoresoft.com/