UdeG Campus used facial recognition without authorization; the data authority will initiate an investigation

The personal data protection office of the state of Jalisco, the Itei, will initiate an ex officio investigation against a campus of the University of Guadalajara that applied a facial recognition system without complying with the law to allow the academic community to enter the campus.

The address of University Center of Exact Sciences and Engineering (CUCEI), in eastern Guadalajara, installed a person identification system with facial biometrics at the access doors to the campus, a technology that uses the characteristics of the face, which are considered sensitive personal data due to their unique and irreplaceable nature. . A loss of this facial biometric information can cause serious damage to the privacy and the right to informational self-determination of the affected people.

In the data protection office there is no information about the system, confirmed Salvador Romero Espinosa, president commissioner of the Institute of Transparency, Public Information and Protection of Personal Data of the State of Jalisco, consulted on the matter.

The campus management installed facial recognition technology without having a privacy impact assessment as required by law when intensive or relevant treatment of personal data is planned, as is the case. Nor does it have a privacy notice that informs people about the treatment that will be given to their sensitive personal data.

CUCEI has 17,743 undergraduate, engineering, master’s and doctoral students. This figure does not include the administrative or academic staff of the campus. It is also unclear whether minors who study English at the Proulex school —owned by the University of Guadalajara and embedded in the campus— are subject to the processing of their sensitive personal data for entering the campus.

“I don’t know if they have minors at Proulex,” said Marco Antonio Pérez Cisneros, rector of CUCEI, in a telephone interview. Proulex’s offer for its “Technological” headquarters includes “English courses for the youngest or little ones in the house” (children and adolescents).

“We are going to prepare a plenary agreement to order the Personal Data Directorate (Itei) to initiate an ex officio verification based on article 83 of the State Law on Personal Data Protection,” said Romero Espinosa.

Romero Espinosa said that he will invite those responsible for treatment at the University of Guadalajara to a work table, “so that they voluntarily join an analysis of the program (at the CUCEI) similar to the one we started next week with the Guadalajara project. ”, in reference to the facial recognition program Your Czech Smile that the Guadalajara City Council wants to use with underage students from 10 public high schools.

“We acquired this technology at the end of 2020 and it was installed in 2021, taking advantage of the fact that the pandemic allowed us to have a very controlled flow” of people on campus, Pérez Cisneros said. Its general application began last February, with the start of the first face-to-face school cycle of 2022. It is intended that its application “be 100%”.

According to Pérez Cisneros, the use of biometric identification is voluntary and the CUCEI community can choose to continue using their credentials to enter the campus.

The registration form of the CUCEI facial recognition system does not have a privacy notice that informs the data subjects of the purposes of the processing of personal information and offers the way to grant, reject or revoke consent. The privacy notice of the University of Guadalajara does not contemplate the use of personal biometric data.

The law orders that, when sensitive personal data is collected and processed, the consent of the owners must be express and in writing from the owner of the data. In the case of minors, their parents or guardians are responsible for granting or denying consent.

The privacy notice is the document that regulates the relationship between the data owners and the data controllers. You should refer to transfers of personal information. The CUCEI system is operated by a private company. “Now I don’t have the name of the company, I’m honest with you,” Pérez Cisneros said.

Last week, the rector Ricardo Villanueva Lomelí, general rector of the University of Guadalajara, justified the use of facial recognition technologies as access tools to academic campuses in response to the levels of insecurity experienced in Jalisco.

“What we are experiencing in schools in terms of security forces us to innovate and think of all alternatives,” said Villanueva Lomelí, referring to a system installed in High School 9 on a population made up mostly of minors. And he warned: “If it works, we can replicate it elsewhere.”

The system in Prepa 9 does not have a privacy notice nor did it present a privacy impact assessment to Itei, as required by law.