5 ms·

"What makes Portland's legislation stand out from other cities is that we're prohibiting facial recognition technology use by private entities in public accommo

"What makes Portland's legislation stand out from other cities is that we're prohibiting facial recognition technology use by private entities in public accommodations," Prohibition is too strict. Better would be to allow opt in, so that my hotel, gym, uber, pizza parlor, etc., could recognize me and customize their service accordingly if I consent.

kstrauser 6y ago
As a practical matter, how could opt in work? Suppose you've opted in and I haven't. We both walk into the pizza parlor. How does the system know that you've opted in without attempting to recognize both of us?
- hirundo 6y ago
  Failing to recognize someone does not detract from their privacy. If they fail to recognize everyone who isn't opted in, who is harmed?
  - farisjarrah 6y ago
    The problem with this argument is the assumption that everyone gets a facial scan and the computer processes the data all the same, in order to recognize whether the individual is recognizable or not. How can we be sure that that data is not getting saved for later? The system is too ripe for abuse and everyone loses their privacy.
  - Pfhreak 6y ago
    Sure it does. Failing to recognize someone at scale can very much impact someone's privacy. Holes in data are, in and of themselves information. For example, if an unrecognized face was logged on 47th street, then an unrecognized face was logged on 50th, then 52nd, then 55th (where a crime occurred), then back down to 47th, you might be able to draw some patterns about where to look for your suspect even if they hadn't opted in. Edit: Also, you are trusting that the system isn't storing markers for people it doesn't recognize. My concern would be that if I opt in later, suddenly all my past history becomes discoverable. That's a lot of trust to put in the hands of private firms (or the police), neither of which I'm comfortable holding that information.
    - kortex 6y ago
      Excellently put. Also, just because it didn't generate a facial ID hit, doesn't mean they can't use ReID and track the descriptor vector. In fact if I were a not-quite ethical user of facerec, I'd flag and bin all vectors and image chips that failed to ID. I work on facerec and ReID. But it's for deep fake detection and the like, blue team stuff. But the deep ID technologies are very concerning to me in general.
    - pc86 6y ago
      Honestly this is a really, really good point I hadn't thought of (and well articulated) and I think you've changed my mind on prohibition v. opt-in.
- stbtrax 6y ago
  It will try to recognize you but you will not be in the database, so it will say match not found. Presumably nothing would be stored about you in that interaction
  - TooCleverByHalf 6y ago
    > Presumably nothing would be stored about you in that interaction Given how prevalent the tracking of users is, anonymous or otherwise, I'd be extremely pessimistic about this assumption.
    - kstrauser 6y ago
      Same here. I don't want the system to even try to recognize me. No one's doing this stuff on site, which means that they'd be uploading my face to a cloud provider and using their system, which means they'd be doing the things people are having a problem with in the first place.
  - markovbot 6y ago
    And no one would ever lie about such things for a profit.
  - thrwn_frthr_awy 6y ago
    Are there logs?
tkzed49 6y ago
I'm suspicious having seen how the GDPR is effectively being circumvented by making nonessential cookies more or less opt-out, and by making the process so annoying that the average person doesn't care enough to do it. It's a lot easier to enforce "not allowed" than "do it in a user-friendly way". Plus, in a public place, how do you only apply facial recognition technology to a single person? It seems like in most cases, you must first apply it to everyone else nearby to discriminate them from anyone who opted in.
- MereInterest 6y ago
  The GDPR isn't being circumvented in those cases. It is being blatantly and flagrantly violated. The GDPR explicitly requires that refusal to be tracked have no more friction than accepting being tracked. If the banner has a "Accept and Continue" button, then it must have a "Refuse and Continue" button as well. Adding any more steps than that is a violation, not merely a circumvention.
lbotos 6y ago
I may be naive and misunderstanding, but if a private entity is using facial recognition on their property, that doesn't appear to be prohibited? Like if a gym wanted to do a face scan to "log you in" that seems like that'd be permissible? I'm not a lawyer. I found the actual draft: D.“Places of Public Accommodation” 1.means: Any place or service offering to the public accommodations, advantages, facilities, or privileges whether in the nature of goods, services, lodgings, amusements, transportation or otherwise. 2.does not include: An institution, bona fide club, private residence, or place of accommodation that is in its nature distinctly private. https://static1.squarespace.com/static/5967c18bff7c50a0244ff42c/t/5f3ad787ba3fd27776e444af/1597691785249/Ordinance+to+ban+use+of+FRT+in+Places+of+Public+Accommodation+plus+code+amendment+-Final.pdf https://static1.squarespace.com/static/5967c18bff7c50a0244ff...
- kstrauser 6y ago
  IANAL, but I think "distinctly private" here means your house, or the private clubhouse you rent with some friends, etc. In other words, places that the general public isn't welcome to visit (as opposed to even a gym where anyone with $100 can sign up).
  - fiter 6y ago
    A private country club would certainly fall under this exemption, but a normal gym might not unless it's already qualifying for the private club tax exemption.
- Reelin 6y ago
  Approximately, a business that's open to the public is considered to be a public space, even if it's on private property. A restaurant dining room is public, but the kitchen would be private (IIUC). A private club (ie you register for membership and only members are allowed inside) is private. (Aside: That's how indoor smoking establishments like hookah bars get around anti-smoking laws in Washington state.) This leaves me uncertain about gyms - that seems more like a country club than a restaurant or hotel?
lwneal 6y ago
A problem with opt-in data collection is that whenever the law allows a user to opt in, businesses will require the user to opt in. A ban on facial recognition doesn't mean much if every hotel, gym, and pizza parlor has a shrink-wrap contract or cookie banner [1] forcing you to opt in to their data collection if you want a room or a pizza. [1] https://news.ycombinator.com/item?id=23090393 https://news.ycombinator.com/item?id=23090393
- justchilly 6y ago
  ...which is fine and well within their rights. Businesses don't have to offer people any services if those people don't want to follow their rules. Under federal anti-discrimination laws, businesses can refuse service to any person for any reason, unless the business is discriminating against a protected class.
  - trevyn 6y ago
    And we are changing those rights, which is fine and well within our rights.
    - toomuchtodo 6y ago
      It is so refreshing to see this asserted, that citizens can update the societal contract through legislation when deemed necessary instead of simply being at the mercy of corporate interests.
      - pc86 6y ago
        This is literally the point of legislation and I haven't seen the opposite asserted even once.
        deleted 6y ago
        [deleted]
  - fiblye 6y ago
fulafel 6y ago
Good opt-in regulation doesn't exist currently - think of all the click-through legalese and cookie popups/gdpr consent popups etc. We'd need something like a once in a lifetime registered consent that service providers would be required to respect quietly and provide non-degraded service to people without the opt-in. Even this would probably require multiple rounds of regulation iteration to fix the loopholes.
willvarfar 6y ago
Would the scanner have to do the recognition stuff _before_ it knows whether the person on-camera has actually opted in?

kstrauser 6y ago

As a practical matter, how could opt in work? Suppose you've opted in and I haven't. We both walk into the pizza parlor. How does the system know that you've opted in without attempting to recognize both of us?

hirundo 6y ago
Failing to recognize someone does not detract from their privacy. If they fail to recognize everyone who isn't opted in, who is harmed?
- farisjarrah 6y ago
  The problem with this argument is the assumption that everyone gets a facial scan and the computer processes the data all the same, in order to recognize whether the individual is recognizable or not. How can we be sure that that data is not getting saved for later? The system is too ripe for abuse and everyone loses their privacy.
- Pfhreak 6y ago
  Sure it does. Failing to recognize someone at scale can very much impact someone's privacy. Holes in data are, in and of themselves information. For example, if an unrecognized face was logged on 47th street, then an unrecognized face was logged on 50th, then 52nd, then 55th (where a crime occurred), then back down to 47th, you might be able to draw some patterns about where to look for your suspect even if they hadn't opted in. Edit: Also, you are trusting that the system isn't storing markers for people it doesn't recognize. My concern would be that if I opt in later, suddenly all my past history becomes discoverable. That's a lot of trust to put in the hands of private firms (or the police), neither of which I'm comfortable holding that information.
  - kortex 6y ago
    Excellently put. Also, just because it didn't generate a facial ID hit, doesn't mean they can't use ReID and track the descriptor vector. In fact if I were a not-quite ethical user of facerec, I'd flag and bin all vectors and image chips that failed to ID. I work on facerec and ReID. But it's for deep fake detection and the like, blue team stuff. But the deep ID technologies are very concerning to me in general.
  - pc86 6y ago
    Honestly this is a really, really good point I hadn't thought of (and well articulated) and I think you've changed my mind on prohibition v. opt-in.
stbtrax 6y ago
It will try to recognize you but you will not be in the database, so it will say match not found. Presumably nothing would be stored about you in that interaction
- TooCleverByHalf 6y ago
  > Presumably nothing would be stored about you in that interaction Given how prevalent the tracking of users is, anonymous or otherwise, I'd be extremely pessimistic about this assumption.
  - kstrauser 6y ago
    Same here. I don't want the system to even try to recognize me. No one's doing this stuff on site, which means that they'd be uploading my face to a cloud provider and using their system, which means they'd be doing the things people are having a problem with in the first place.
- markovbot 6y ago
  And no one would ever lie about such things for a profit.
- thrwn_frthr_awy 6y ago
  Are there logs?

tkzed49 6y ago

I'm suspicious having seen how the GDPR is effectively being circumvented by making nonessential cookies more or less opt-out, and by making the process so annoying that the average person doesn't care enough to do it. It's a lot easier to enforce "not allowed" than "do it in a user-friendly way". Plus, in a public place, how do you only apply facial recognition technology to a single person? It seems like in most cases, you must first apply it to everyone else nearby to discriminate them from anyone who opted in.

MereInterest 6y ago
The GDPR isn't being circumvented in those cases. It is being blatantly and flagrantly violated. The GDPR explicitly requires that refusal to be tracked have no more friction than accepting being tracked. If the banner has a "Accept and Continue" button, then it must have a "Refuse and Continue" button as well. Adding any more steps than that is a violation, not merely a circumvention.

lbotos 6y ago

I may be naive and misunderstanding, but if a private entity is using facial recognition on their property, that doesn't appear to be prohibited? Like if a gym wanted to do a face scan to "log you in" that seems like that'd be permissible? I'm not a lawyer. I found the actual draft: D.“Places of Public Accommodation” 1.means: Any place or service offering to the public accommodations, advantages, facilities, or privileges whether in the nature of goods, services, lodgings, amusements, transportation or otherwise. 2.does not include: An institution, bona fide club, private residence, or place of accommodation that is in its nature distinctly private. https://static1.squarespace.com/static/5967c18bff7c50a0244ff42c/t/5f3ad787ba3fd27776e444af/1597691785249/Ordinance+to+ban+use+of+FRT+in+Places+of+Public+Accommodation+plus+code+amendment+-Final.pdf https://static1.squarespace.com/static/5967c18bff7c50a0244ff...

kstrauser 6y ago
IANAL, but I think "distinctly private" here means your house, or the private clubhouse you rent with some friends, etc. In other words, places that the general public isn't welcome to visit (as opposed to even a gym where anyone with $100 can sign up).
- fiter 6y ago
  A private country club would certainly fall under this exemption, but a normal gym might not unless it's already qualifying for the private club tax exemption.
Reelin 6y ago
Approximately, a business that's open to the public is considered to be a public space, even if it's on private property. A restaurant dining room is public, but the kitchen would be private (IIUC). A private club (ie you register for membership and only members are allowed inside) is private. (Aside: That's how indoor smoking establishments like hookah bars get around anti-smoking laws in Washington state.) This leaves me uncertain about gyms - that seems more like a country club than a restaurant or hotel?

lwneal 6y ago

A problem with opt-in data collection is that whenever the law allows a user to opt in, businesses will require the user to opt in. A ban on facial recognition doesn't mean much if every hotel, gym, and pizza parlor has a shrink-wrap contract or cookie banner [1] forcing you to opt in to their data collection if you want a room or a pizza. [1] https://news.ycombinator.com/item?id=23090393 https://news.ycombinator.com/item?id=23090393

justchilly 6y ago
...which is fine and well within their rights. Businesses don't have to offer people any services if those people don't want to follow their rules. Under federal anti-discrimination laws, businesses can refuse service to any person for any reason, unless the business is discriminating against a protected class.
- trevyn 6y ago
  And we are changing those rights, which is fine and well within our rights.
  - toomuchtodo 6y ago
    It is so refreshing to see this asserted, that citizens can update the societal contract through legislation when deemed necessary instead of simply being at the mercy of corporate interests.
    - pc86 6y ago
      This is literally the point of legislation and I haven't seen the opposite asserted even once.
      - deleted 6y ago
        [deleted]
- fiblye 6y ago

fulafel 6y ago

Good opt-in regulation doesn't exist currently - think of all the click-through legalese and cookie popups/gdpr consent popups etc. We'd need something like a once in a lifetime registered consent that service providers would be required to respect quietly and provide non-degraded service to people without the opt-in. Even this would probably require multiple rounds of regulation iteration to fix the loopholes.

willvarfar 6y ago

Would the scanner have to do the recognition stuff _before_ it knows whether the person on-camera has actually opted in?