4 ms·

That's just bizarre. This would never, ever, fly under the GDPR.

resoluteteeth 7y ago
Are you sure? According to what the airline said, the airline doesn't have the facial recognition data; rather they are just taking photos from passengers who opt in to board via this method, and the photos only need to be stored for a few seconds so they can be sent to DHS for verification. The airline isn't taking or storing photos of passengers who don't opt into this process, but it is presumably sending the government a list of all passengers prior to boarding so that photos of passengers who opt in can be verified. Would this violate the GDPR?
- viraptor 7y ago
  s/who opt in/who don't opt out/ according to the tweets. But you're right, and the process is surprisingly reasonable as long as the implementation is safe
- bluntfang 7y ago
  do you actually believe that the twitter PR person has enough technical knowledge of this process to make such bold claims as to whether they store people's data or not? And if you do believe they would have enough knowledge, do you believe they would EVER tell the truth?
  - zaat 7y ago
    I believe the PR person have the knowledge by proxy, someone is directing him. I also believe that DHS won't give them sensitive information without requiring them to conform to the relevant regulations. I can't say I'm certain it is fail-proof, and it defiantly can feel spooky but not everybody is lying to you all the time. From the article the PR quoted, I arrived to the relevant executive order that facilitated this, section 8: https://www.whitehouse.gov/presidential-actions/executive-order-protecting-nation-foreign-terrorist-entry-united-states-2/ https://www.whitehouse.gov/presidential-actions/executive-or...
- ProAm 7y ago
  > According to what the airline said, the airline doesn't have the facial recognition data I absolutely do not believe the tweets from a company PR representative as to how their technology actually works.
  - kruegel 7y ago
    Regardless of whether this PR person knows anything or not, I think the much more likely scenario is that they are sending facial recognition requests to a CBP API vs. building their own facial recognition database with 100s of millions of identities out of thin air.
    - craftinator 7y ago
      But they have your photo after they take it, and the CBP verifies for them who you are. From this information transfer, the airline can replicate the CBP database entry for each person that it takes a picture of... In the long run, they can build a facial recognition database of everyone who flies. Am I wrong about this?
      - oh_sigh 7y ago
        No, but whether they actually are or not is another question. They could also build the same database 10 years ago by taking your picture as you scanned your boarding pass.
        craftinator 7y ago
        I haven't done international travel (by normal means), have they always taken your picture for that? Thanks for the info!
        oh_sigh 7y ago
        No, but they could surreptitiously take your photo if they wanted to. I doubt there is much expectation of privacy at an airport gate
- ttul 7y ago
  The government already sees all the flight manifests. Assuming that it also has a database of photos from passports, the matching process doesn't violate anyone's privacy, since they opted in to have their photo matched in the first place.
code4tee 7y ago
I’ve used similar systems recently in Europe so it would appear GDPR is cool with it... It seems they are simply asking for identify verification by sending the photo to a remote DHS server for verification. How is this different than showing a ticket agent your passport and having them scan it? That’s the same photo in question. GDPR doesn’t get you out of having to verify your identity in person against a government photo for boarding a flight. In fact, one could argue the method in question is actually more secure and private because you never actually have to share your passport photo directly with JetBlue.
notimetorelax 7y ago
In this case since the company does not store the images GDPR doesn’t apply.
- wizeman 7y ago
  Doesn't the GDPR also apply to entities that process personal data (as opposed to only those that store it)? AFAIK it should apply to entities that share personal data with third parties, for instance.
- GordonS 7y ago
  Even if they don't retain the images, it's a veritable treasure trove for security agencies, who will almost certainly be hoovering them up, either with or without the company's knowledge.
  - iNate2000 7y ago
    It's been a few years since I traveled international - but CBP already takes pictures at passport control, don't they?
    - jrockway 7y ago
      I have never had my picture taken while leaving the United States, which is what this sounds like. Arriving? Sure.
      - unreal37 7y ago
        You have not had this knowingly. You have not posed for a photo. But surely, the government has plenty of cameras in customs areas and face recognition has been a thing for a decade.
        acct1771 7y ago
        Now think about the attributes they're recording from your phone when you approach.
amichal 7y ago
it would actually, biometric ids etc are allowed for various regulated reasons -- identifying folks who cross national boundaries is likely one of them
CamperBob2 7y ago
I believe that if you study the language of the GDPR, you'll find that "it's OK if the government does it."
ferongr 7y ago
Implying that European states would pass laws that limited their power over the cizitenry.
ajross 7y ago
Driver's licenses surely have photos still in EU nations, right? I don't think the GDPR speaks to this.
nemothekid 7y ago
If I am understanding this correctly this would be ok under the GDPR because the government is the one holding the data bag. They got the images from CBP.

Are you sure? According to what the airline said, the airline doesn't have the facial recognition data; rather they are just taking photos from passengers who opt in to board via this method, and the photos only need to be stored for a few seconds so they can be sent to DHS for verification. The airline isn't taking or storing photos of passengers who don't opt into this process, but it is presumably sending the government a list of all passengers prior to boarding so that photos of passengers who opt in can be verified. Would this violate the GDPR?

viraptor 7y ago
s/who opt in/who don't opt out/ according to the tweets. But you're right, and the process is surprisingly reasonable as long as the implementation is safe
bluntfang 7y ago
do you actually believe that the twitter PR person has enough technical knowledge of this process to make such bold claims as to whether they store people's data or not? And if you do believe they would have enough knowledge, do you believe they would EVER tell the truth?
- zaat 7y ago
  I believe the PR person have the knowledge by proxy, someone is directing him. I also believe that DHS won't give them sensitive information without requiring them to conform to the relevant regulations. I can't say I'm certain it is fail-proof, and it defiantly can feel spooky but not everybody is lying to you all the time. From the article the PR quoted, I arrived to the relevant executive order that facilitated this, section 8: https://www.whitehouse.gov/presidential-actions/executive-order-protecting-nation-foreign-terrorist-entry-united-states-2/ https://www.whitehouse.gov/presidential-actions/executive-or...
ProAm 7y ago
> According to what the airline said, the airline doesn't have the facial recognition data I absolutely do not believe the tweets from a company PR representative as to how their technology actually works.
- kruegel 7y ago
  Regardless of whether this PR person knows anything or not, I think the much more likely scenario is that they are sending facial recognition requests to a CBP API vs. building their own facial recognition database with 100s of millions of identities out of thin air.
  - craftinator 7y ago
    But they have your photo after they take it, and the CBP verifies for them who you are. From this information transfer, the airline can replicate the CBP database entry for each person that it takes a picture of... In the long run, they can build a facial recognition database of everyone who flies. Am I wrong about this?
    - oh_sigh 7y ago
      No, but whether they actually are or not is another question. They could also build the same database 10 years ago by taking your picture as you scanned your boarding pass.
      - craftinator 7y ago
        I haven't done international travel (by normal means), have they always taken your picture for that? Thanks for the info!
        oh_sigh 7y ago
        No, but they could surreptitiously take your photo if they wanted to. I doubt there is much expectation of privacy at an airport gate
ttul 7y ago
The government already sees all the flight manifests. Assuming that it also has a database of photos from passports, the matching process doesn't violate anyone's privacy, since they opted in to have their photo matched in the first place.

code4tee 7y ago

I’ve used similar systems recently in Europe so it would appear GDPR is cool with it... It seems they are simply asking for identify verification by sending the photo to a remote DHS server for verification. How is this different than showing a ticket agent your passport and having them scan it? That’s the same photo in question. GDPR doesn’t get you out of having to verify your identity in person against a government photo for boarding a flight. In fact, one could argue the method in question is actually more secure and private because you never actually have to share your passport photo directly with JetBlue.

notimetorelax 7y ago

In this case since the company does not store the images GDPR doesn’t apply.

wizeman 7y ago
Doesn't the GDPR also apply to entities that process personal data (as opposed to only those that store it)? AFAIK it should apply to entities that share personal data with third parties, for instance.
GordonS 7y ago
Even if they don't retain the images, it's a veritable treasure trove for security agencies, who will almost certainly be hoovering them up, either with or without the company's knowledge.
- iNate2000 7y ago
  It's been a few years since I traveled international - but CBP already takes pictures at passport control, don't they?
  - jrockway 7y ago
    I have never had my picture taken while leaving the United States, which is what this sounds like. Arriving? Sure.
    - unreal37 7y ago
      You have not had this knowingly. You have not posed for a photo. But surely, the government has plenty of cameras in customs areas and face recognition has been a thing for a decade.
      - acct1771 7y ago
        Now think about the attributes they're recording from your phone when you approach.

amichal 7y ago

it would actually, biometric ids etc are allowed for various regulated reasons -- identifying folks who cross national boundaries is likely one of them

CamperBob2 7y ago

I believe that if you study the language of the GDPR, you'll find that "it's OK if the government does it."

ferongr 7y ago

Implying that European states would pass laws that limited their power over the cizitenry.

ajross 7y ago

Driver's licenses surely have photos still in EU nations, right? I don't think the GDPR speaks to this.

nemothekid 7y ago

If I am understanding this correctly this would be ok under the GDPR because the government is the one holding the data bag. They got the images from CBP.