Facial Recognition Access Systems (FRAS), invasion of privacy and the danger of abuse of information

- Another Pecanwood Homeowners Association inept decision that has far reaching legal consequences

Photo: Benjamin Lehman

As with the unlawful implementation of a Stabilisation Fund and signing a lease agreement with the Malaysians, once again the PHOA are aiming to introduce something that has not been well thought through, is illegal, and will have serious implications for residents, tenants, and visitors on to the estate. A few ill-informed and emotional residents with unwarranted fears for their safety or those standing to benefit monetarily from the transaction will once again agree with the PHOA, to the detriment of others and notwithstanding the fact that the two recent housebreakings are not attributed to non-residents.

On 19 May 2022 the Pecanwood Homeowners Association (PHOA) unveiled their plans for an ambitious state-of-the-art Facial Recognition Technology (FRT) system which they intend members to pay for through a special levy.

Access for residents and tenants on to the Estate is currently through a Morpho contactless access card or fingerprint system. Visitors gain access through the Morpho pin code facility integrated into the PHOA app.

The estate manager Hannes Hendricks recently said in a Town Hall meeting that the software for the system has become obsolete and that he can no longer monitor entry and exit logs.

Several members who attended the meeting have advised that the access system has not been maintained regularly as funds were instead redirected to the maintenance and upgrading of the Malaysian owned golf course and club house building and the boat club rather than the communal property and equipment which evidently require extensive repairs and maintenance. Members attending the meeting were not told if the software of the Morpho system can be upgraded at a cheaper cost to residents rather than having the system replaced in its entirety. No alternative was proposed for members who are entitled by the Constitution of the Republic of South Africa to opt out of participating in the FRAS.

There is a continuing worldwide trend to introduce facial recognition systems to combat criminal activity by identifying suspects in large groups and to monitor consumer behaviours for retailers. Our Newsletter will aim to deal with the success rate of the former, the requirements of POPIA, the Protection of Private Information Act 2013 which came into effect in 2020 and the role of the Information Regulator in as concise a manner as possible.

The introduction of a Facial Recognition Access System (FRAS) on to the estate will require the installation of several cameras at all entry and exit points, including access to the gym, the contractors’ gate and the school gate leading to Pecanwood College.

One of our residents has forwarded us a recording of a meeting wherein Hannes Hendricks advised that the new security system will also have cameras installed in strategic locations inside the estate, all connected to a Bluetooth system that will track the movement of vehicles and golf carts. Hendricks has voiced in Town Hall meetings his opinion on domestic servants and teenagers who apparently drive golf carts without being licensed. The proposed system will therefore reportedly be a complete biometric identification and tracking surveillance system of residents and their families, contractors, employees, and visitors. In effect we will be going back to a police state which means, inter alia the controllers of the system can choose who to monitor and who not. Anyone monitoring or having access to the system will know exactly where you are on the estate and will also have unprecedented access to the private information of individuals depending on the capability and integration of the system. This infringes on the right to privacy guaranteed by our constitution in article 14 and further articulated in Section 5 of the POPI Act of 2013. And no, POPI has nothing to do with your cellphone number.

Anyone doubting the actions of the PHOA should remember that the SIMCARD of the Pecanwood Corruption Watch (PCW) has been nefariously cloned to cut off one of its communication channels to members. Besides the aforementioned the PHOA has already defined itself as a group that is above the law and that, amongst other things, is evidenced by taking decisions that contravene the law and the well documented blatant disregard of the MOI and the Companies Act 2008 attest to that. They, and anybody that they are currently grooming to take over the security portfolio of the PHOA cannot be trusted with the collection, processing, and storage of personal information of members, and neither can the security companies that they employ on the estate.

Considering the dismal performance of FRT in law enforcement circles worldwide it is unlikely that the technology will be helpful in combating crime on the estate. British media reported in early 2019 that the London Metropolitan Police’s FRT system had a failure rate of 81% in tracking crime. At the Notting Hill Carnival it had a failure rate of 91% in identifying people. Here in South Africa the cameras used in the Johannesburg City Centre as part of its crime prevention initiative were banned in the USA due to its cybercrime shortcomings.

Facial Recognition Technology was also used extensively by police in the USA during the Black Lives Matter protests to identify persons who oppose racial discrimination and police brutality. As a result of this Microsoft and IBM refuse the use of their software in applications that violate their corporate disclosure and transparency policies.

Based on pseudoscience invented by the Nazis, FRT has inherent biases towards people of colour and lacks the ability to represent them adequately. With its Apartheid history involving the passbook system and legacy that flares up from time to time, the use of FRAS in South Africa and on a residential estate where black people were banned from settling prior to the abolishment of the Group Areas Act is therefore an affront to all people of colour. Considering that the Chairman of the PHOA board is himself a black man who should be cognizant of all these issues it further highlights that this proposed new security system has not been thought through.

At a recent Town Hall meeting Hendricks reportedly pointed out that the two biggest crimes being perpetrated on the estate are related to domestic violence and children scrawling on buildings and paving with crayons. Damage to property, vandalism and house breakings comprise a small percentage of crimes on the estate and in these instances residents too, are allegedly involved as Hendricks has assured members that there has not been a perimeter fence breach. As a precautionary tool for crime, the FRT is unnecessary as it will achieve nothing unless it is linked to the South African Police Services data base, which violates several other laws and is an infringement on POPIA. Further, as the PHOA and its security company will be taking over the role of law enforcement in identifying suspects and tracking them they will be doing it on the common property of the estate which is still defined in law as private property and their actions will be unlawful and criminal.

According to Intellectual Property Specialist and Attorney and Legal Advisor Senamiso Moyo, “The Act defines personal information as information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person. Section 5 of the Act provides that a data subject has the right to have his or her personal information processed in accordance with the conditions for the lawful processing set out under the act. This includes the right to be notified that personal information about him or her is being collected, amongst other things. Furthermore, it also includes the right to request such personal information as well as to object to its use. The people whose information is being collected have a right to be informed of what and how their personal information is collected, as well as why.”*

Even if the PHOA opts for a basic FRT access system that will only collect photographs of an individual’s face and will be restricted as to what data is being collected and integrated into unknown systems, Moyo further notes: “The Constitutional right to privacy is closely tied to various other fundamental rights entrenched in the Constitution such as the right to dignity. It specifically deals with a person’s right to be left alone and live life free from unwarranted publicity. This unwarranted publicity extends to third parties such as tech companies who use a wide range of invasive technology. That is where the harm lies and this collection of the personal information itself without the consumer's consent is a harmful consequence, irrespective of what the collector intends to do with it thereafter. For example, collecting pictures of someone and storing them without doing anything with them might not be harmful immediately, however, it creates unwarranted publicity and invariably breaches the notion of being left alone. This shows that for privacy to be breached, harm need not necessarily immediately ensue.” *

It is illegal to employ Facial Identification Technology to automatically identify an individual and we quote, “a data subject may not be subject to a decision which results in legal consequences for him, her or it, or which affects him, her or it to a substantial degree, which is based solely on the basis of the automated processing of personal information intended to provide a profile of such person including his or her performance at work, or his, her or its credit worthiness, reliability, location, health, personal preferences or conduct.”**

According to Estate Living, since the introduction of the POPIA several estates have opted to remove their CCTV cameras altogether and are cautious about the use of FRT as part of their access systems. Several have had to deal with the Information Regulator, the statutory enforcement and compliance body for the POPI Act.

The use of biometric information without consent from the Information Regulator is expressly prohibited by the POPIA. Facial Recognition Technology cannot be legally used for identification without applying to the Information Regulator for exemption and obtaining the necessary permission for its use.

We were informed at the last Town Hall meeting that the FRAS is based on a risk assessment that was done before 2019 by a consulting company that engaged Hannes Hendricks. This was before POPIA came into effect on 01 July 2020 with a 12-month grace period that expired in 2021. Our position is that the PHOA should apply to the Information Regulator for permission to implement the FRAS and once the permission is obtained, approach residents with the proposal for the system and an opt out option for residents who may choose not to be part of the FRAS.

Apart from the legal contraventions and ramifications that the PHOA’s current proposal will bring about, we believe that the decision is not only premature but the costs associated with its implementation defy business logic and there is no doubt that the current and future security threats will not be addressed effectively by this intervention.

The PHOA’s proposal will result in spending millions of Rands on a system that could amount to wasteful expenditure and criminal and civil charges if the law is not complied with.

* Facial Recognition Technology vs The POPI Act - Senamiso Moyo (Legal Advisor, Intellectual Property specialist, Attorney, Trade Marks Practitioner - LinkedIn.Com Profile Article - 01 April 2020

** De Klerk and Van Gend Attorneys - IP/IT Law : Facial Recognition Technology Under POPIA - 24 June 2021

Please visit our Downloads Page for a copy of the Information Regulator exemption application form and further links to relevant information mentioned in this article.

© Pecanwood Corruption Watch