In the past as well as now the Customs and Border Protection of the USA has been questioned on their failure to provide complete and accurate privacy notices and conduct appropriate audits. This time it is to ensure the agency’s facial recognition technology used for identity checks comply with privacy standards set by the legal privacy framework.
The Government Accountability Office has published the audit report which says that the communication practices relating to how CBP informs the public are problematic. The information about its facial recognition programs is inadequate. This includes a lack of informative actions and analysis such as the use of signs with inaccurate information or signs. These are hard to see at ports of entry such as land border crossings, international airports and seaports.
The CBP has also audited just one of its 27 airline partners involved in deploying facial recognition technology. This will help in gauging whether the involved partners are complying with the privacy policies set out by the law.
GAO completed the audit at the request of Rep. Bennie Thompson, D-Miss., who is chairman of the House Homeland Security Committee, and Sens. Ron Johnson, R-Wis., and Gary Peters, D-Mich., chairman along with the members of the Senate Homeland Security and Governmental Affairs Committees, respectively.
According to the auditors: “We have done a number of reviews looking at CBP’s efforts to develop and implement a biometric entry and exit system and we have, over the years, identified long-standing challenges in CBP’s efforts to develop and implement that system,” Gambler said.
The technology was properly implemented in May 2020. The privacy protection practices are not up to the international best practices yet.
Privacy findings fall into two categories:
- Upholding privacy commitments by informing the public about facial recognition technology, including information about how to opt-out of participation in the program.
- CBP’s plans to conduct oversight of the program’s partners.
Now, the GAO’s audit is based on visits to sites where facial recognition technology is deployed, interviews with local CBP agents. They shall engage in reviews of program documents like schedules and reports from pilot tests. A series of Data and Privacy Impact Assessments will follow. A joint CBP and Transportation Security Administration report on facial recognition technology will be then submitted to Congress.
GAO found multiple problems with signage at airports which will now be updated.
“The notices are really intended to provide travellers with information about CBP’s use of facial recognition technology, including locations where the technology is deployed and how the data collected is going to be used, and the notices are also to provide information on procedures for opting out if that’s applicable,” Auditors mentioned.