Facial Recognition Technology — From Controversy to Commonplace. Is Your Building Ready?

A Technology That Has Moved From Science Fiction to Site Security

Until relatively recently, facial recognition technology was the preserve of law enforcement and national security agencies. Today, it is available as a standard feature on commercial IP CCTV systems at price points that are increasingly accessible to commercial building operators. The question for building managers and security professionals is no longer whether facial recognition works — it does — but whether it is appropriate for their premises, and what obligations come with deploying it.

This article explains how the technology works, where it is being deployed in commercial settings, the legal framework governing its use in the UK, and the practical considerations for building managers who are considering adding facial recognition capability to their CCTV infrastructure.

How Commercial Facial Recognition Works

Modern commercial facial recognition systems work by analysing the geometric features of a person's face — the distance between eyes, the shape of the jaw, the position of facial landmarks — and converting them into a numerical 'faceprint'. This faceprint is then compared against a database of stored faceprints in real time.

In a commercial access control context, this means that a pre-enrolled employee or resident can pass through an entry point without presenting a fob or card — their face is their credential. In a security and watchlist context, it means that individuals of interest — banned visitors, known shoplifters, individuals subject to trespass orders — can be identified the moment they enter a monitored zone.

The accuracy of modern systems has improved dramatically. Leading commercial systems now achieve false acceptance rates below 0.01% in controlled conditions, and are capable of operating effectively across a range of lighting conditions, face angles and partial obscurations.

Where Is It Being Used?

• Managed residential developments — frictionless access for residents, instant alert for non-enrolled individuals
• Hotels — fast check-in, room access without physical keys, VIP recognition
• Retail and hospitality — watchlist matching for banned individuals, loss prevention
• Commercial offices — access control for secure areas, attendance management
• High-security sites — multi-factor authentication combining facial recognition with PIN or fob

The Legal Framework in the UK

Facial recognition data is classed as biometric data under UK GDPR — a special category of personal data that attracts heightened protection. Using facial recognition in a commercial setting therefore requires a lawful basis for processing, typically either explicit consent from enrolled individuals or a legitimate interests assessment that can withstand scrutiny.

The Information Commissioner's Office (ICO) has published specific guidance on the use of live facial recognition in public-facing settings, emphasising the requirements for transparency, necessity and proportionality. The ICO has taken enforcement action against organisations that have deployed facial recognition without adequate legal basis.

For most commercial building operators, the practical implication is that facial recognition must be accompanied by a Data Protection Impact Assessment (DPIA), clear signage informing individuals that facial recognition is in use, and a documented lawful basis for processing. We recommend taking legal advice before deploying any facial recognition system in a public-facing environment.