For the prohibition in Article 5(1)(e) AI Act to apply, the source of the facial images may either be the Internet or CCTV footage . Regarding the internet , the fact that a person has published facial images of themselves on a social media platform does not mean that that person has given his or her consent for those images to be included in a facial recognition database. Examples of scraping facial images fro m CCTV footage include images acquired by surveillance cameras operated in places such as airports, streets, parks, etc. Example: A facial recognition software company collects pictures of faces. The photographs held by the company have been scraped from social media ( e.g., Facebook, YouTube, Twitter, Venmo) with an ‘automated image scraper’ that searches the internet and detects images containing human faces. It collects those images with any associated information (such as the source of the image (URL), the geo-localisation, and sometimes the names of the individuals). The facial features are then extracted from the images and transformed into mathematical representations, whic h are hashed for indexation and future comparison. When a user uploads the image of an individual to the AI system , that system will determine whether that image matches a face in the database. The uploaded image will go through the same mathematical trans formation as the scraped images.
Where an AI system receives a picture of a person and searches the face on the internet for matches, i.e. ‘reverse engineering image search engines’, thiswill be considered to be targeted scraping. Moreover, it is questionable whether the matches would appear in a ‘database’.