Eight Dutch holiday parks forced to remove facial recognition

The Dutch data protection authority (DPA) has forced eight holiday parks to get rid of cameras equipped with facial recognition software that were installed to gain access to swimming pools and playgrounds.

The Autoriteit Persoonsgegevens (AP) launched an investigation into the matter after it received several complaints from citizens.

“People were surprised. They were used to entering the pool with a card or wristband, and suddenly facial recognition made its entrance. Not just for adults, but for children as well. Just to be able to enter the pool. They wanted to know whether that was allowed or not,” AP Vice Chair Monique Verdier says in a statement.

All the holiday parks the Dutch privacy supervisor reviewed, breached the General Data Protection Regulation (GDPR) in numerous ways. For example, they didn’t inform their guests what data was collected and how long it would be stored.

In addition, some holiday parks didn’t tell visitors they could also visit the pool without submitting themselves to facial recognition. And in some cases parks didn’t offer an alternative to access the pool or playground.

“This is very serious. You cannot pressure people to give up their biometric data. Yet, that is what happened here. People pay to have a nice holiday, including access to a swimming pool, and are put on the spot: if you want to swim, you have to give up your data. That’s not allowed,” Verdier clarifies.

The GDPR basically prohibits the use of facial recognition, because it is considered sensitive personal information. However, there are three exceptions:

• If facial recognition has a personal purpose, like unlocking your phone
• If facial recognition is necessary for authentication or security purposes, like entering a secured area
• If the person whose face is being scanned consents to this

None of these exceptions were applicable to the holiday parks, or guests simply weren’t informed properly about their rights, the AP concludes.

Seven out of the eight parks that were investigated have removed facial recognition cameras. If the eight park doesn’t make any changes, the Dutch DPA may choose to impose a fine or penalty. The park has until December to remove its facial recognition cameras.