Contract analysis

From: Kevin Ostrowski <k.ostrowski@calderwoodharkness.com> To: Fiona Gallagher <fiona.gallagher@northgatetelecom.co.uk> Cc: Sanjay Mehta <sanjay.mehta@northgatetelecom.co.uk> Subject: DPIA-008: CCTV & Facial Recognition Pilot (London HQ) — Recommendation to discontinue [PRIVILEGED & CONFIDENTIAL — LEGAL ADVICE]

**PRIVILEGED & CONFIDENTIAL — LEGAL ADVICE**

Further to our engagement (ref: SC/NTP/2023-0213/PDS), I am writing to convey the outcome and recommendation arising from DPIA-008, which assessed Northgate Telecommunications PLC's ("NTP") proposed CCTV and facial recognition pilot at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. The full DPIA report is attached for your review ahead of the Board Audit & Risk Committee meeting scheduled for 14 June 202

As you are aware, NTP proposed deploying a facial recognition system integrated with the existing CCTV infrastructure at Northgate Tower for the purposes of enhanced physical security and access control. The pilot was intended to supplement the existing biometric access control system (badge and fingerprint), which was separately assessed under DPIA-005. The proposed system would process biometric data — specifically

A DPIA was mandatory under Article 35(1) given that the processing involves: (i) systematic monitoring of a publicly accessible area; (ii) large-scale processing of special category (biometric) data; and (iii) the use of innovative technology. The DPIA was prepared by Sara Hendricks as part of Phase 3 of our engagement, in consultation with Thomas Okoye (CISO) and relevant NTP security personnel. We are grateful to T

The DPIA identified a number of significant risks which, in our view, are not capable of being reduced to an acceptable level. The principal findings are as follows:

1. **Lawful basis and Article 9 condition.** Facial recognition generates and processes biometric data, triggering the requirement for both a lawful basis under Article 6 and a separate condition under Article 9. Neither is straightforward to establish in this context. Explicit consent from employees is problematic given the well-recognised employer-employee power imbalance — consent in an employment relationship can

2. **Proportionality.** The stated objective is enhanced physical security at London HQ. However, NTP already operates conventional CCTV and a separate biometric access control system (badge and fingerprint). The incremental security benefit of adding facial recognition over and above these existing measures is marginal and, in our assessment, does not justify the significant additional intrusion into data subjects'

3. **Breadth of data subjects affected.** The system would capture biometric data not only of the approximately 2,500 NTP employees based at Northgate Tower but also of contractors, temporary workers, visitors, and potentially members of the public present in reception and lobby areas. Several of these categories of data subjects cannot meaningfully consent, and many would have no prior relationship with NTP.

4. **Accuracy and bias risks.** Facial recognition technology carries well-documented risks of algorithmic bias, particularly concerning differential accuracy rates across different demographic groups. The potential for false positives and false negatives creates tangible risks of discriminatory outcomes and wrongful security interventions, with consequential impacts on affected individuals and potential liability fo

5. **Regulatory scrutiny.** The ICO has issued specific guidance expressing significant concerns about the use of live facial recognition in workplaces and semi-public spaces. Given NTP's prior enforcement history — specifically, ICO Enforcement Notice ENF/2021/0934, which resulted in a £320,000 fine — and the active Data Protection Commission inquiry (ref: IN-22-11-3), deploying a high-profile facial recognition sys

6. **Data minimisation.** The volume of biometric data that would be generated and retained by the system is excessive relative to the stated purpose. The DPIA concluded that the processing does not satisfy the data minimisation principle under Article 5(1)(c).

7. **Residual risk.** Critically, even after applying all reasonably practicable mitigation measures — including restricting coverage zones, limiting retention periods, implementing strict access controls on biometric templates, and conducting regular accuracy audits — the residual risk to data subjects' rights and freedoms remains high. The DPIA concluded that these residual risks cannot be reduced to an acceptable

In light of the above, **Calderwood & Harkness's recommendation is that NTP should discontinue the facial recognition pilot.** Our rationale is as follows:

- The processing is disproportionate to the stated security objectives, given the availability of less intrusive alternatives already in place at Northgate Tower. - The residual risks to data subjects' rights and freedoms cannot be sufficiently mitigated through supplementary technical or organisational measures. - Were NTP to proceed, it would be required to undertake prior consultation with the ICO under Article 36

I should note that this recommendation applies to the facial recognition component specifically. The existing conventional CCTV system and the biometric access controls assessed under DPIA-005 are separate workstreams and remain in place unaffected by this recommendation.

We would recommend the following course of action:

1. **Board presentation.** We recommend that you present DPIA-008 and the discontinuation recommendation to the Board Audit & Risk Committee at the meeting on 14 June 2023. Either Sara Hendricks or I are available to attend the meeting to brief the Committee directly, should that be helpful.

2. **If the Board accepts the recommendation,** NTP should formally document the decision to discontinue, notify the internal project sponsor, and ensure that any biometric data collected during any testing phase is securely and verifiably deleted in accordance with NTP's data retention and destruction procedures.

3. **DPIA register.** Sanjay should record the DPIA outcome and the Board's decision in the DPIA Summary Register.

4. **Alternative approaches.** If the Board wishes to explore alternatives — for example, enhanced conventional CCTV analytics that do not involve biometric processing — we would be happy to advise on a revised DPIA scope for any such proposal.

Fiona, I appreciate this is not the outcome the security team was hoping for, but I am confident the analysis is sound and that discontinuation is the right course of action in the circumstances. I am very happy to discuss this by phone or in person ahead of Wednesday's Board session — please do let me know if that would be useful, or if you have any questions on the attached report.

The full DPIA-008 report is attached and is marked privileged and confidential.

**Kevin Ostrowski** Partner, Privacy & Data Security Calderwood & Harkness LLP One Moorgate Square London EC2R 6AN

Tel: +44 (0)20 7946 0128 Mob: +44 (0)7700 900 413 Email: k.ostrowski@calderwoodharkness.com

Attachment: DPIA-008 — CCTV & Facial Recognition Pilot (Full Report) (dpia-008-cctv-facial-recognition.docx)

*This email and any attachments are sent on behalf of Calderwood & Harkness LLP and are confidential and subject to legal professional privilege. They are intended solely for the use of the named addressee(s). If you have received this email in error, please notify the sender immediately and delete this email from your system. You must not copy, distribute, or take any action in reliance on it. Calderwood & Harkness