Biometric Data Definition: 3 Questions a Face Scan Must Answer

Right now, in Scotland, there's a camera scanning shoppers as they walk into a store, and there's no rule on the books that clearly says it can't. The only official strategy governing public surveillance cameras there was written back in 2011. That's before the iPhone 4 shipped, before live facial recognition had a name, before any of this was even imaginable to the people who wrote the rules.

If that unsettles you, good, it should

If that unsettles you, good, it should. Because here's what most of us assume without thinking about it. If facial recognition is legal where we live, then someone must be watching over it. If you've ever unlocked your phone with your face, or walked past a camera at a train station, this touches you already. But "legal" and "governed" turn out to be two completely different things. So how does one camera end up with almost no meaningful oversight, and why does that matter for your face specifically?

Let's start with the mistake almost everyone makes. We treat facial recognition like it's one single thing. One technology, one rule, one yes-or-no question. But that's not how it actually works.

Picture one camera. Just one. Now watch what it can become depending on who's using it. In one case, a detective uploads your photo to check it against suspects. The result is a match score, seen by a few authorized investigators, deleted when the case closes. In another case, that same camera scans a live crowd, flagging people in real time for multiple officers watching at once. And in a third case, a store uses it to track how often you visit and what you buy, building a behavior profile that might get sold to marketers and kept forever.

Same camera

Same camera. Same software. Three completely different levels of risk to you. For a lawyer, that means one legal framework can't possibly cover all three. For the rest of us, it means the word "facial recognition" is hiding three very different things inside it.

There's a reason a hotel keycard makes this click. The card itself is just plastic and a magnetic strip, totally neutral. But what it does depends entirely on how the hotel programmed it. Maybe it opens only your room. Maybe it opens your room for three days, then expires. Maybe it's a master key that opens every door and gets logged each time. A rule that just says "keycards are allowed" tells you nothing useful. Your face works the same way. The image is inert until a policy decides who can see it, what they can do with it, and when it gets destroyed.

And that deletion question? It hits harder than you'd think. Because your face isn't like a password. If your password leaks, you change it in thirty seconds. If someone steals the mathematical map of your face, you can't issue yourself a new one. Experts warn this is exactly why facial data breaches fuel identity theft and stalking, a face, once exposed, stays exposed.