Assess a retail facial-recognition collection under the sensitive-information rules
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- State whether the images are used or stored to identify a consumer, whether the business's notice lists biometric information, and whether the consumer has directed the business to limit use of sensitive personal information. Do not treat an ordinary photograph, with no recognition use, as that category.
- What the lawyer must review
- The Attorney General's CCPA page includes fingerprints, retina or iris images, and other unique biometric data used to identify a person, and it says photographs are not included unless they are used or stored for facial recognition. The same page treats biometric information processed to identify a consumer as sensitive personal information, which the consumer can direct the business to use only for limited purposes. The California Privacy Protection Agency's FAQ likewise lists biometric information used to identify a consumer as sensitive personal information and states the right to limit that use and disclosure. Both pages are California law for California residents of a covered business. They are not a national biometric statute.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes identifying points for review. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.