CONFIDENTIAL — LEGAL PRIVILEGED
DATA PROTECTION IMPACT ASSESSMENT
DPIA-008: CCTV AND FACIAL RECOGNITION PILOT
NORTHGATE TOWER, LONDON HQ
This document has been prepared by Calderwood & Harkness LLP on behalf of Northgate Telecommunications PLC ("NTP") pursuant to engagement reference SC/NTP/2023-0213/PDS. It is subject to legal professional privilege and is provided for the sole use of the instructing parties. This document must not be disclosed to third parties without the prior written consent of Calderwood & Harkness LLP and NTP. Nothing in this document constitutes a guarantee or warranty as to the outcome of any regulatory interaction or enforcement action.
VERSION CONTROL AND APPROVAL
Approval:
This DPIA was presented to the NTP Board Audit & Risk Committee on 14 June 2023 by Kevin Ostrowski (Calderwood & Harkness LLP), with Sanjay Mehta (DPO) and Fiona Gallagher (General Counsel & Company Secretary) in attendance. The Board accepted the recommendation to discontinue the facial recognition pilot and authorised the continued deployment of standard CCTV without facial recognition overlay, subject to the conditions set out in Section 8.2 of this assessment.
Right-click to update Table of Contents
1. EXECUTIVE SUMMARY
Northgate Telecommunications PLC ("NTP" or the "Company") proposes to deploy a closed-circuit television ("CCTV") system enhanced with live facial recognition technology ("FRT") at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, the Company's principal office (the "Pilot"). The Pilot would involve the installation of 47 CCTV cameras across five floors, building entrance lobbies, the ground-floor reception area, car park entry and exit points, three lift lobbies, and two secure server room corridors. Of these 47 cameras, 12 would be equipped with a live facial recognition overlay, positioned at the main entrance (four cameras), the reception desk (two cameras), executive floor access points (three cameras), and server room corridors (three cameras).
The stated purpose of the Pilot is to enhance physical security at Northgate Tower, prevent unauthorised access to sensitive areas (including server rooms and executive floors), enable real-time identification of individuals on security watchlists, and integrate facial recognition capability with NTP's existing biometric access control systems. The Pilot was proposed for a duration of six months.
This Data Protection Impact Assessment ("DPIA") has been prepared by Calderwood & Harkness LLP at the instruction of NTP's Data Protection Officer, Sanjay Mehta, and is conducted as part of NTP's comprehensive GDPR compliance programme (Phase 3 DPIA workstream, engagement reference SC/NTP/2023-0213/PDS). The assessment was commenced on 22 May 2023 and completed on 12 June 2023.
DPIA Trigger. This DPIA is triggered under Article 35 of the General Data Protection Regulation ("GDPR") and the UK GDPR because the proposed processing involves: (a) systematic monitoring of a publicly accessible area on a large scale; (b) the use of biometric data for the purpose of uniquely identifying natural persons, constituting special category data under Article 9 of the GDPR; and (c) the deployment of innovative technology in the form of live facial recognition. The processing meets at least five of the nine screening criteria published by the Information Commissioner's Office ("ICO") and referenced in the European Data Protection Board ("EDPB") Guidelines on Data Protection Impact Assessments (wp248rev.01), which expressly identify facial recognition technology as a category of processing likely to require a DPIA.
Risk Classification. The overall risk classification of this DPIA is High Risk. The assessment has identified five residual risks to the rights and freedoms of data subjects that cannot be adequately mitigated to an acceptable level through the technical and organisational measures proposed or considered. These risks relate to: (1) disproportionate intrusion into private life; (2) algorithmic bias and discrimination; (3) data security risks associated with a centralised biometric database; (4) unlawful processing of visitor and member-of-the-public data without a valid lawful basis; and (5) heightened regulatory and reputational risk in light of NTP's existing ICO enforcement history.
Conclusion. Calderwood & Harkness LLP concludes that the facial recognition component of the Pilot should be discontinued. The residual risks to data subjects' rights and freedoms — including the disproportionate intrusion into private life inherent in continuous biometric identification, the chilling effects on free movement within the workplace, the documented risk of algorithmic bias and discriminatory outcomes, the data security risks associated with the storage of a centralised biometric template database of approximately 2,450 individuals, and the absence of a robust lawful basis for processing — cannot be sufficiently mitigated through any combination of technical or organisational measures. The processing is disproportionate to the stated security objectives, which can be achieved through less intrusive means already available to NTP, including standard CCTV without facial recognition, enhanced access card systems with anti-tailgating turnstiles, existing biometric fingerprint access controls at data centre server rooms (previously assessed under DPIA-005), and additional security personnel.
Standard CCTV without facial recognition overlay may continue at Northgate Tower subject to the separate proportionality controls and conditions set out in Section 8.2 of this assessment.
The NTP Board Audit & Risk Committee accepted this recommendation on 14 June 2023 and directed that the facial recognition Pilot be discontinued. The Board authorised the continued deployment of standard CCTV (without facial recognition) subject to the conditions specified in this DPIA.
2. INTRODUCTION AND LEGAL FRAMEWORK
2.1 Purpose of this DPIA
Article 35(1) of the GDPR, as retained and supplemented by the Data Protection Act 2018 ("DPA 2018") (together, the "UK GDPR"), provides that where a type of processing, in particular using new technologies and taking into account the nature, scope, context, and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.
The purpose of this DPIA is to systematically identify, assess, and, where possible, mitigate the data protection risks arising from NTP's proposed deployment of CCTV cameras enhanced with live facial recognition technology at Northgate Tower, London E14 5HN. This DPIA is conducted before the Pilot commences and constitutes a pre-deployment assessment. It is intended to inform NTP's decision as to whether the Pilot should proceed, proceed with modifications, or be discontinued.
This DPIA has been prepared by Calderwood & Harkness LLP as part of NTP's comprehensive GDPR compliance programme build, under engagement reference SC/NTP/2023-0213/PDS. Calderwood & Harkness LLP was engaged by NTP to provide specialist privacy and data security legal advice in connection with NTP's ongoing compliance programme, and the present assessment forms part of the Phase 3 DPIA workstream under that engagement. The assessment has been conducted in accordance with Article 35(7) of the GDPR, the ICO's published guidance on conducting DPIAs, and the EDPB's Guidelines on Data Protection Impact Assessments (wp248rev.01, as last revised and adopted on 4 October 2017).
2.2 Legal Basis for Requiring a DPIA
The requirement to conduct a DPIA in respect of the proposed processing is established by multiple overlapping provisions of the GDPR, UK GDPR, and relevant regulatory guidance:
Article 35(3)(c) GDPR / UK GDPR. A DPIA is specifically required where the processing involves "a systematic monitoring of a publicly accessible area on a large scale." Northgate Tower's ground-floor entrance lobby, reception area, and building perimeter are accessible to visitors and members of the public, and the proposed deployment of 47 CCTV cameras (12 with facial recognition) across the building constitutes large-scale systematic monitoring within the meaning of Article 35(3)(c).
ICO DPIA Screening Criteria. The ICO has published guidance identifying nine criteria that controllers should use to screen processing activities for DPIA requirements. Where processing meets two or more of these criteria, a DPIA is generally required. The proposed Pilot meets at least five of the nine criteria:
(a) Systematic monitoring: Continuous real-time video surveillance and facial recognition monitoring of building occupants and visitors.
(b) Sensitive data or data of a highly personal nature: Processing of biometric data (facial recognition templates) constituting special category data under Article 9(1) GDPR.
(c) Innovative use or applying new technological or organisational solutions: Live facial recognition technology deployed in a workplace setting represents an innovative use of technology.
(d) Data processed on a large scale: Approximately 2,100 employees, 350 contractors, and 200–400 daily visitors affected, with continuous processing throughout business hours and beyond.
(e) Data subjects who might be considered vulnerable: Employees in an employment context are recognised as being in a position of power imbalance relative to the controller-employer, rendering them vulnerable data subjects for the purposes of DPIA screening (see EDPB Opinion 2/2017 on data processing at work).
EDPB Guidelines on DPIAs (wp248rev.01). The European Data Protection Board's Guidelines on Data Protection Impact Assessments expressly identify facial recognition technology as a category of processing that is likely to require a DPIA, particularly where it involves the identification of data subjects in public or semi-public spaces.
ICO Published List of Processing Operations Requiring a DPIA. Pursuant to Section 57 of the Data Protection Act 2018, the ICO has published a list of the types of processing operations that require a DPIA. This list includes the use of biometric data for identification purposes and the deployment of innovative technologies for systematic monitoring, both of which are features of the proposed Pilot.
2.3 Applicable Legal Framework
This DPIA has been conducted with reference to the following legal and regulatory framework:
Primary Data Protection Legislation:
• UK GDPR — the General Data Protection Regulation (EU) 2016/679, as retained in UK domestic law under the European Union (Withdrawal) Act 2018, as supplemented and modified by the Data Protection Act 2018.
• Data Protection Act 2018 ("DPA 2018") — the UK's domestic data protection legislation, including Schedule 1 (conditions for processing special category data and criminal offence data).
• GDPR Article 5 — principles relating to the processing of personal data, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
• GDPR Article 6 — lawfulness of processing, including the legitimate interests basis (Article 6(1)(f)).
• GDPR Article 9 — processing of special categories of personal data, including biometric data processed for the purpose of uniquely identifying a natural person.
• GDPR Article 25 — data protection by design and by default.
• GDPR Articles 35 and 36 — data protection impact assessments and prior consultation with the supervisory authority.
Surveillance and Human Rights Legislation:
• Surveillance Camera Code of Practice — issued by the Secretary of State under Section 30 of the Protection of Freedoms Act 2012 and currently overseen by the Surveillance Camera Commissioner. The Code establishes 12 guiding principles for the use of surveillance camera systems in England and Wales and applies to any relevant authority, including private organisations operating surveillance cameras in areas to which the public has access.
• Protection of Freedoms Act 2012 — establishes the statutory framework for the regulation of CCTV and other surveillance camera systems.
• Human Rights Act 1998 — gives domestic effect to the rights and freedoms guaranteed under the European Convention on Human Rights ("ECHR"), including Article 8 (right to respect for private and family life, home, and correspondence). The deployment of facial recognition technology in a workplace engages Article 8 and requires a proportionality assessment.
Equality Legislation:
• Equality Act 2010 — prohibits discrimination on the grounds of protected characteristics, including race, sex, age, and disability. The documented differential accuracy rates of facial recognition algorithms across demographic groups raise concerns under the Equality Act regarding the potential for indirect discrimination.
Regulatory Registration and Enforcement Context:
• NTP's ICO Registration Number is ZA482917.
• NTP received ICO Enforcement Notice ENF/2021/0934 on 15 September 2021, accompanied by a monetary penalty of £320,000, in respect of historic data protection failures. This enforcement history places NTP under heightened regulatory scrutiny and underscores the importance of rigorous compliance with data protection obligations in connection with any new processing activities involving personal data, particularly special category data.
• The Irish Data Protection Commission ("DPC") has an active inquiry (Reference IN-22-11-3) into NTP's subsidiary operations in the Republic of Ireland. While this inquiry relates to distinct processing activities, it contributes to the overall regulatory risk profile relevant to this assessment.
3. DESCRIPTION OF THE PROPOSED PROCESSING
3.1 Overview of the Pilot
NTP proposes to deploy a CCTV and facial recognition pilot programme at its principal office, Northgate Tower, located at 88 Canary Wharf Boulevard, London E14 5HN. Northgate Tower is a 22-storey commercial office building that serves as NTP's global headquarters and houses the Company's executive leadership, core corporate functions, and a significant proportion of its UK-based workforce.
The Pilot is proposed for a duration of six months from the date of initial deployment, with a review point at three months. The stated purpose of the Pilot is to evaluate the operational effectiveness of facial recognition technology as an enhancement to NTP's existing physical security infrastructure at Northgate Tower.
Scope of CCTV Deployment. The Pilot involves the installation of a total of 47 CCTV cameras across the following areas of Northgate Tower:
• Five office floors (Floors 3, 7, 12, 16, and 21), covering corridor entry points and common areas;
• The building entrance lobby at ground-floor level;
• The ground-floor reception area;
• The car park entry and exit barriers at basement levels B1 and B2;
• Three lift lobbies (ground floor, Floor 12, and Floor 21); and
• Two secure server room corridors (Floor 5 and Floor 9).
Facial Recognition Component. Of the 47 cameras, 12 cameras would be equipped with a live facial recognition overlay. These 12 cameras are positioned at the following locations:
• Main building entrance: 4 cameras;
• Reception desk area: 2 cameras;
• Executive floor access points (Floors 16 and 21): 3 cameras; and
• Server room corridors (Floors 5 and 9): 3 cameras.
The remaining 35 cameras would operate as standard CCTV cameras, recording video footage without facial recognition processing.
Technology Description. The facial recognition system proposed for the Pilot uses a neural network-based algorithm to perform real-time facial identification. The system captures live video feed from the 12 designated cameras, extracts facial biometric templates (mathematical representations of facial geometry) from the images of individuals captured by the cameras, and matches those templates in real time against a pre-enrolled reference database of authorised personnel. The system generates a match or no-match result, which is displayed on a security team monitoring dashboard. In the event of a no-match (an unrecognised individual in a restricted area) or a match against a security watchlist, the system generates an automated alert to the on-duty security team for manual review and response.
3.2 Categories of Personal Data
The proposed processing involves the following categories of personal data:
(a) Facial images — photographs and video footage of individuals captured by the CCTV cameras. These constitute personal data, as they relate to identified or identifiable natural persons.
(b) Facial biometric templates — mathematical representations of facial geometry extracted from captured facial images for the purpose of real-time matching against the enrolled reference database. These constitute special category data under Article 9(1) of the GDPR, as they are biometric data processed for the purpose of uniquely identifying a natural person.
(c) Time and date stamps — records of the time and date at which each individual's image is captured by the CCTV system, including the time at which facial recognition matching is performed.
(d) Location within the building — camera zone identifiers indicating the specific area of Northgate Tower in which an individual's image is captured (e.g., "Main Entrance — Camera 3," "Server Room Corridor Floor 5 — Camera 1").
(e) Employee and contractor identification data — the name, employee or contractor identification number, department, and job title of individuals enrolled in the facial recognition reference database, which are linked to the enrolled biometric templates.
(f) Incidental visitor facial images — facial images of visitors and members of the public who are not enrolled in the reference database but whose images are incidentally captured by cameras at the building entrance, reception area, and other areas accessible to non-employees.
It is critical to note that the processing of facial biometric templates for identification purposes constitutes the processing of special category data. Article 9(1) of the GDPR specifically identifies "biometric data for the purpose of uniquely identifying a natural person" as a special category of personal data, the processing of which is prohibited unless one of the conditions set out in Article 9(2) is satisfied. The significance of this classification cannot be overstated, as it imposes substantially more stringent requirements on the lawfulness, necessity, and proportionality of the processing.
3.3 Categories of Data Subjects
The proposed processing would affect the following categories of data subjects:
(a) NTP employees based at Northgate Tower — approximately 2,100 staff across all departments and seniority levels. All employees who routinely enter and move within Northgate Tower would be subject to CCTV surveillance and, in the areas covered by the 12 facial recognition cameras, to live biometric identification.
(b) Contractors and temporary workers with building access — approximately 350 individuals at any given time, including IT contractors, cleaning and maintenance staff, consultants, and agency workers engaged by NTP.
(c) Visitors — including clients, suppliers, job candidates, delivery personnel, and other individuals attending Northgate Tower for meetings, interviews, or business purposes. NTP estimates that Northgate Tower receives approximately 200 to 400 visitors per day during normal business operations.
(d) Members of the public — individuals who are incidentally captured by cameras positioned at or near the building entrance and ground-floor areas. While Northgate Tower is a private commercial building, the entrance lobby and immediate perimeter are accessible to the public, and individuals passing by or entering the ground-floor lobby area (which includes a publicly accessible café) may be captured by the CCTV cameras.
The total number of data subjects affected by the CCTV system (with and without facial recognition) is substantial, encompassing the full population of Northgate Tower occupants and visitors on any given day. The facial recognition component specifically affects all individuals who pass through the 12 camera zones, whether or not they are enrolled in the reference database. Individuals who are not enrolled will have their facial images captured and biometric templates extracted and compared against the database, resulting in a "no-match" outcome. This means that visitors and members of the public will be subject to biometric processing without enrolment and, as discussed further in Section 4.3, without a clear lawful basis.
3.4 Data Flows
The data flows associated with the proposed Pilot are as follows:
Step 1 — Image Capture. The 47 CCTV cameras capture live video feed on a continuous basis during operating hours (and on a 24-hour basis for cameras covering external entry points and server room corridors). The 12 facial recognition-enabled cameras simultaneously capture facial images within their field of view.
Step 2 — On-Premises Processing. The live video feed from the 12 facial recognition cameras is transmitted via a dedicated internal network to an on-premises processing unit located in the Northgate Tower data centre (Floor 5). This processing unit hosts the facial recognition algorithm provided by the technology supplier, Veridian Security Technologies Ltd. No data leaves the NTP premises at any stage of processing.
Step 3 — Biometric Template Extraction. The facial recognition algorithm extracts biometric templates (mathematical representations of facial geometry) from the facial images captured in the live video feed. This extraction occurs in real time as individuals pass within the camera field of view.
Step 4 — Matching. The extracted biometric templates are compared in real time against the enrolled reference database, which is stored on an NTP on-premises server encrypted at rest using AES-256 encryption. The reference database contains biometric templates of approximately 2,450 authorised individuals (consisting of approximately 2,100 employees and 350 regular contractors), derived from enrolment photographs taken during HR onboarding or contractor registration processes.
Step 5 — Match/No-Match Output. The matching process generates one of two outcomes: (a) a match, confirming that the individual is an enrolled authorised person; or (b) a no-match, indicating that the individual is not recognised. In the case of a no-match in a restricted area, or a match against a designated security watchlist, an automated alert is generated on the security team monitoring dashboard for manual review.
Step 6 — Security Team Response. On-duty security personnel review dashboard alerts and take appropriate action (e.g., approaching an unrecognised individual in a restricted area, verifying identity through alternative means).
Data Retention. Video footage from all 47 cameras is retained on NTP on-premises storage for a period of 30 days, after which it is automatically overwritten. Biometric templates derived from live facial recognition processing are not retained beyond the real-time comparison; they are deleted immediately after the match/no-match result is generated. The enrolled reference database is maintained on a continuous basis, with biometric templates added upon enrolment and removed upon de-enrolment (e.g., when an employee leaves the Company or a contractor's engagement ends).
No International Transfer. All processing, including video footage storage, biometric template extraction and matching, and enrolled reference database storage, takes place entirely on NTP's on-premises infrastructure at Northgate Tower. No personal data or biometric data is transferred outside the United Kingdom.
3.5 Processor and Technology Supplier
The facial recognition technology proposed for the Pilot would be supplied by Veridian Security Technologies Ltd ("Veridian"), a UK-based security technology vendor retained by NTP's facilities management team. Veridian would supply, install, and maintain the facial recognition hardware and software, including the neural network-based matching algorithm.
Under the proposed arrangement, Veridian would act as a data processor within the meaning of Article 4(8) of the GDPR, processing personal data (including biometric data) on behalf of NTP as controller. Article 28 of the GDPR requires that processing by a processor be governed by a written contract that sets out the subject-matter and duration of processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller.
As of the date of this DPIA, no data processing agreement has been executed between NTP and Veridian that addresses the processing of biometric data in connection with the Pilot. This represents a significant compliance gap. If the Pilot were to proceed, NTP would be required to negotiate and execute a data processing agreement with Veridian that includes, at a minimum: (a) obligations on Veridian to process biometric data only on NTP's documented instructions; (b) confidentiality obligations binding on Veridian's personnel; (c) appropriate technical and organisational security measures; (d) restrictions on sub-processing; (e) obligations to assist NTP with data subject rights requests; (f) obligations to assist NTP with DPIA and prior consultation obligations; (g) data deletion or return obligations upon termination; and (h) audit and inspection rights for NTP.
The absence of a processor agreement is a further indicator that the Pilot is not ready for deployment from a compliance perspective, and reinforces the recommendation to discontinue the facial recognition component.
3.6 Relationship to Other DPIAs
This DPIA (NTP-DPIA-008) should be read in the context of NTP's wider DPIA programme, and in particular in conjunction with DPIA-005 (Biometric Access Control System — Data Centres).
DPIA-005 was conducted in February 2023 and assessed the use of biometric fingerprint access controls at NTP's data centres located in London, Frankfurt, Amsterdam, and Dublin. DPIA-005 concluded that the fingerprint biometric access controls at these data centre locations were necessary and proportionate, given the specific sensitivity of data centre environments, the limited number of data subjects affected (approximately 120 authorised personnel across all four sites), the closed and non-public nature of the environments, and the absence of less intrusive alternatives that would provide equivalent security for data centre infrastructure.
The present DPIA is materially distinct from DPIA-005 in several critical respects. First, the proposed Pilot involves facial recognition (a more intrusive form of biometric identification than fingerprint scanning, as it can be performed at a distance and without the active participation or knowledge of the data subject). Second, the proposed deployment is at a semi-public office environment (Northgate Tower), rather than a closed data centre facility with no public access. Third, the scale of processing is an order of magnitude larger — approximately 2,450 enrolled individuals and 200–400 daily visitors, compared to 120 authorised personnel at data centre sites. Fourth, the proposed processing involves the incidental capture of visitors and members of the public, which was not a feature of the data centre biometric access controls.
For these reasons, the conclusions of DPIA-005 do not support the proposition that facial recognition at Northgate Tower is necessary or proportionate. Each DPIA must be assessed on its own facts, and the materially different context of the present Pilot leads to a fundamentally different risk assessment and conclusion.
4. ASSESSMENT OF NECESSITY AND PROPORTIONALITY
4.1 Stated Purpose and Legitimate Interest
NTP's facilities management team and Chief Security Officer have articulated the following objectives for the proposed CCTV and facial recognition Pilot at Northgate Tower:
(a) Enhance physical security at London HQ by deploying advanced surveillance technology capable of real-time identification of building occupants.
(b) Prevent unauthorised access to secure areas within Northgate Tower, including server rooms on Floors 5 and 9 and executive floors on Floors 16 and 21, through automated identification of individuals in restricted zones.
(c) Real-time identification of individuals on security watchlists, including former employees whose access has been revoked, individuals subject to restraining orders or trespass notices, and other persons of interest identified by the security team.
(d) Complement the existing access card system, which is acknowledged to be vulnerable to tailgating (individuals following authorised card-holders through controlled entry points without presenting their own credentials) and to the misuse of lost or stolen access cards.
Proposed Lawful Basis — Article 6. NTP has proposed to rely on Article 6(1)(f) of the GDPR — legitimate interests of the controller — as the lawful basis for the processing of personal data (non-biometric data) in connection with the Pilot. NTP asserts that the security of its premises, the protection of its assets (including IT infrastructure in server rooms and confidential information on executive floors), and the safety of its personnel constitute legitimate interests that are not overridden by the interests or fundamental rights and freedoms of data subjects.
Proposed Condition for Special Category Data — Article 9. For the processing of biometric data (facial recognition templates), which constitutes special category data, NTP must satisfy one of the conditions set out in Article 9(2) of the GDPR in addition to the Article 6 lawful basis. NTP has proposed to rely on a combination of two conditions:
(a) Article 9(2)(a) — explicit consent — for employees and contractors who are enrolled in the facial recognition reference database. NTP proposes to obtain explicit written consent from each enrolled individual during the enrolment process.
(b) Article 9(2)(g) — substantial public interest — for the incidental processing of facial images and biometric templates of visitors and members of the public who are not enrolled in the reference database but whose biometric data is processed when the facial recognition system attempts to match their facial images against the enrolled database.
As set out in Section 4.3 below, both of these proposed conditions are problematic, and Calderwood & Harkness LLP does not consider that either provides a robust lawful basis for the processing.
4.2 Necessity Assessment
Article 35(7)(b) of the GDPR requires that a DPIA include an assessment of the necessity and proportionality of the processing operations in relation to the purposes. The principle of data minimisation (Article 5(1)(c)) further requires that personal data be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
The central question for the necessity assessment is whether the processing of biometric data through live facial recognition is necessary — that is, whether it is the least intrusive means available to NTP to achieve the stated security objectives, or whether less intrusive alternatives exist that would achieve the same or substantially the same objectives without the processing of special category biometric data.
Calderwood & Harkness LLP has evaluated the following alternative measures, each of which is either already deployed at Northgate Tower or could be deployed at materially lower cost and privacy impact:
(a) Standard CCTV without facial recognition. NTP already operates a CCTV system at Northgate Tower comprising 32 cameras. The proposed Pilot would expand this to 47 cameras but, critically, only 12 of those cameras would incorporate facial recognition. Standard CCTV provides a visual deterrent, facilitates incident investigation, and enables security personnel to monitor building areas in real time. It achieves the security objectives of surveillance and deterrence without processing biometric data.
(b) Enhanced access card system with anti-tailgating turnstiles. NTP's existing access card system could be upgraded with anti-tailgating turnstiles at building entrance points and controlled access corridors. Turnstiles designed to permit passage by only one individual per card presentation effectively address the tailgating vulnerability identified by NTP. The access card system can also be enhanced with additional fraud prevention measures such as photo-on-card verification and rapid card deactivation protocols for lost or stolen cards.
(c) Security personnel stationed at entry points. NTP already employs four security guards at the ground-floor entrance and two at the car park entry. Additional security personnel can be deployed at executive floor access points and server room corridors to provide manual identity verification, including visual identification checks against photo ID.
(d) Two-factor authentication for secure areas. Access to server rooms and executive floors can be controlled through a two-factor authentication system combining the access card with a personal identification number (PIN) or a one-time passcode delivered to the individual's registered mobile device. This approach significantly reduces the risk of unauthorised access using lost or stolen access cards without processing biometric data.
(e) Existing biometric access controls at data centre server rooms. NTP has already deployed biometric fingerprint access controls at its data centre server rooms, which were assessed and approved under DPIA-005. These controls provide a targeted, proportionate biometric security layer for the most sensitive areas. Extending facial recognition to the entire building goes far beyond what was assessed and approved under DPIA-005.
Conclusion on Necessity. Having considered the available alternatives, Calderwood & Harkness LLP concludes that facial recognition technology is not necessary to achieve NTP's stated security objectives at Northgate Tower. The alternative measures identified above — individually and in combination — are capable of achieving the same or substantially the same security outcomes without the processing of special category biometric data. The incremental security benefit of facial recognition over these alternative measures is marginal and does not justify the processing of biometric data at the scale proposed.
It is acknowledged that facial recognition technology may offer certain operational efficiencies (e.g., automated identification without requiring individuals to present a card or enter a PIN). However, operational convenience is not the same as necessity. The GDPR's necessity requirement demands that the processing be necessary to achieve the stated purpose, not merely convenient or advantageous. The fact that less intrusive alternatives exist and are already partially deployed at Northgate Tower is determinative.
4.3 Proportionality Assessment
Even if the facial recognition processing could be characterised as necessary (which, as set out above, it cannot), it would fail the proportionality assessment. The proportionality analysis requires a balancing of the benefits of the processing against the risks to data subjects' rights and freedoms, taking into account the nature and intrusiveness of the processing, the expectations of data subjects, and the availability of less intrusive alternatives.
Scale of Intrusion. The proposed processing involves the continuous, real-time biometric identification of approximately 2,100 employees, 350 contractors, and 200 to 400 daily visitors, plus the incidental capture of members of the public at the building entrance and ground-floor areas. This constitutes mass biometric surveillance of a building population on a continuous basis throughout operating hours. The intrusion into data subjects' rights is profound: individuals would be subject to automated biometric identification simply by entering or moving within their place of work, without any active participation on their part. The surveillance is not targeted at specific individuals suspected of wrongdoing but is applied indiscriminately to all building occupants and visitors.
Chilling Effects. Academic literature, case law, and regulatory guidance consistently recognise that mass surveillance technologies — and biometric surveillance in particular — create "chilling effects" on the exercise of fundamental rights, including the right to privacy (Article 8 ECHR), freedom of expression, and freedom of association. In the workplace context, the knowledge that one's facial features are being continuously scanned and matched against a database may inhibit employees' willingness to move freely, to associate with colleagues, and to exercise workplace rights (including the right to participate in trade union activities). These chilling effects are a form of harm in themselves, regardless of whether any adverse action is taken as a result of the surveillance.
Consent Viability. NTP's proposal to rely on explicit consent from employees (Article 9(2)(a)) as the condition for processing biometric data is fundamentally flawed. The EDPB has consistently held, and the ICO has confirmed, that consent is generally not a valid lawful basis for processing in the employment context due to the inherent power imbalance between employer and employee. An employee cannot be said to "freely give" consent within the meaning of Article 4(11) and Article 7 of the GDPR when the refusal to consent may result in an inability to access the workplace or adverse treatment. EDPB Opinion 2/2017 on data processing at work specifically addresses this point and concludes that employers should not rely on consent as the lawful basis for processing where the employee has no genuine choice or where the consequences of refusal would be detrimental.
In the present case, if facial recognition is the method of biometric identification at building entrance and access points, an employee who refuses consent would face practical difficulties entering the building or accessing their workstation. Even if NTP were to offer an alternative entrance or access route for non-consenting employees, this would create a conspicuous two-tier access system that stigmatises individuals who exercise their right to refuse consent, further undermining the voluntary nature of the consent.
Substantial Public Interest Basis. NTP's proposed reliance on Article 9(2)(g) (substantial public interest) for the processing of biometric data of visitors and members of the public is also problematic. Article 9(2)(g) requires that the processing be necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection, and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
In the UK, the DPA 2018, Schedule 1, Part 2 sets out the conditions that may be relied upon as a "substantial public interest" basis for processing special category data. NTP has identified Paragraph 10 of Part 2 of Schedule 1 ("preventing or detecting unlawful acts") as the potentially applicable condition. However, this condition requires that the processing must be necessary for the purposes of the prevention or detection of an unlawful act and must be carried out without the consent of the data subject "so as not to prejudice those purposes." This condition is primarily designed for law enforcement-adjacent processing and is of uncertain application to routine corporate security measures. The ICO has not endorsed the use of this condition for general workplace facial recognition. Reliance on this condition for the incidental processing of visitor and public biometric data is, in Calderwood & Harkness LLP's assessment, legally uncertain and carries a significant risk of challenge.
Proportionality Conclusion. The processing is disproportionate to the stated security objectives. The scale and intrusiveness of continuous biometric surveillance of the entire Northgate Tower population — including employees, contractors, visitors, and members of the public — substantially outweighs the incremental security benefit that facial recognition would provide over and above the alternative measures already available to NTP. The processing cannot be made proportionate through technical or organisational measures alone; the disproportionality is inherent in the nature of the processing itself.
4.4 Data Minimisation and Storage Limitation
Calderwood & Harkness LLP acknowledges one positive aspect of NTP's proposed design: the proposal not to retain biometric templates derived from live facial recognition processing beyond the real-time matching event. The immediate deletion of live-captured biometric templates after match/no-match determination is consistent with the principle of storage limitation and reduces, but does not eliminate, the data security risks associated with biometric processing.
However, this design choice does not address the fundamental data minimisation concern. The enrolled reference database itself constitutes a centralised biometric database containing the facial recognition templates of approximately 2,450 individuals. This database is a permanent repository of special category data that must be maintained and updated on an ongoing basis for the facial recognition system to function. The existence of such a database represents a high-value target for cyberattack and a significant ongoing data security risk, as discussed further in Section 5.2 (Risk 3).
Furthermore, the retention of video footage for 30 days has been assessed as generally reasonable for standard CCTV purposes (i.e., for the investigation of security incidents or other events within a reasonable period after occurrence). However, the retention of video footage captured by the 12 facial recognition cameras raises additional concerns, as this footage contains the raw facial images from which biometric templates can be re-extracted. Even if biometric templates are deleted in real time, the retained video footage provides the capability to re-process and re-extract biometric data at any point during the 30-day retention period. No separate justification has been provided for retaining facial recognition-enriched footage for this period.
Finally, no data minimisation analysis has been applied to the scope of cameras equipped with facial recognition capability. Of the 12 cameras, several are positioned in non-sensitive areas (the building entrance lobby and reception desk) where the security justification for biometric identification is weaker than at server room corridors or executive floor access points. A genuinely data-minimised approach would limit facial recognition to the smallest number of cameras covering only the most sensitive areas — but even this reduced scope would not, in Calderwood & Harkness LLP's assessment, resolve the proportionality and lawful basis concerns.
4.5 Compliance with the Surveillance Camera Code of Practice
The Surveillance Camera Code of Practice, issued under Section 30 of the Protection of Freedoms Act 2012, establishes 12 guiding principles that apply to the operation of surveillance camera systems in England and Wales. While the Code is not directly enforceable against private organisations, the ICO has confirmed that compliance with the Code is a relevant consideration in the assessment of whether processing involving CCTV and surveillance technologies is fair and proportionate under the GDPR.
Calderwood & Harkness LLP has assessed the proposed Pilot against the 12 guiding principles and has identified areas of non-compliance with the following principles:
Principle 1 — Use of surveillance camera systems must always be for a specified purpose which is in pursuit of a legitimate aim and necessary to meet an identified pressing need. As set out in Section 4.2, the necessity of the facial recognition component has not been demonstrated. The identified pressing need (physical security) can be met through less intrusive means.
Principle 3 — There must be as much transparency in the use of a surveillance camera system as possible, including a published contact point for access to information and complaints. While NTP has proposed to display signage and provide privacy notices, the processing of biometric data through facial recognition goes beyond what would be reasonably expected by data subjects entering a commercial office building. Transparency measures do not resolve the fundamental issue of disproportionate processing.
Principle 4 — There must be clear responsibility and accountability for all surveillance camera system activities including images and information collected, held and used. NTP has not established a clear governance framework for the biometric data processed through the Pilot. No data processing agreement has been executed with Veridian (the technology supplier), no designated system owner has been appointed, and no biometric data governance policy has been developed.
Principle 9 — Regular reviews should be undertaken to ensure that the use of surveillance remains justified. The current Pilot proposal does not include a structured review schedule for the facial recognition component, beyond a general review at the three-month and six-month points. No criteria have been defined for assessing whether the processing remains justified at each review point, and no mechanism has been established for independent review or audit.
Compliance with the remaining principles (Principles 2, 5, 6, 7, 8, 10, 11, and 12) has not been fully assessed in detail, as the assessment has concluded that the Pilot should be discontinued on necessity and proportionality grounds. If NTP were to proceed with the Pilot contrary to this recommendation, a comprehensive assessment against all 12 principles would be required.
5. IDENTIFICATION AND ASSESSMENT OF RISKS
5.1 Risk Methodology
The risks identified in this DPIA have been assessed using a risk assessment methodology consistent with the ICO's DPIA guidance and the EDPB Guidelines on Data Protection Impact Assessments. Risks are assessed on a matrix of likelihood and severity to data subjects' rights and freedoms:
Likelihood:
• Remote: The event could occur in exceptional circumstances.
• Possible: The event could occur at some point.
• Probable: The event is more likely than not to occur.
Severity:
• Minimal: Negligible impact on data subjects' rights and freedoms. Minor inconvenience that data subjects can easily overcome.
• Significant: Considerable impact on data subjects' rights and freedoms. Data subjects may encounter significant difficulties which they will be able to overcome, but with serious effort.
• Severe: Serious impact on data subjects' rights and freedoms. Data subjects may encounter significant or even irreversible consequences which they may not overcome.
Overall Risk Rating:
Risks are assessed on a pre-mitigation basis (inherent risk) and a residual basis (after consideration of all proposed and potential mitigation measures). The assessment focuses on residual risk, as this determines whether the processing can proceed without prior consultation with the ICO under Article 36.
5.2 Risk Register
Risk 1: Disproportionate Intrusion into Private Life
Risk Description. The continuous, real-time biometric surveillance of employees, contractors, and visitors at Northgate Tower constitutes a significant and disproportionate interference with the right to respect for private life guaranteed by Article 8 of the ECHR, given domestic effect by the Human Rights Act 1998. The processing goes beyond what is reasonably expected by data subjects entering a commercial office building and creates a pervasive monitoring environment in which individuals are subject to automated biometric identification throughout their time in the building.
The deployment of live facial recognition in the workplace is qualitatively different from standard CCTV surveillance. While standard CCTV captures images that may be reviewed by security personnel in the event of an incident, facial recognition involves the automated extraction and processing of biometric data — a unique and immutable biological characteristic — for the purpose of identifying each individual in real time. This represents a fundamentally more intrusive form of surveillance that engages individuals' most sensitive personal data.
The chilling effect of such surveillance on employees' behaviour and workplace interactions is a significant harm in itself. Employees may feel inhibited from moving freely within the building, from taking breaks in common areas, from meeting with colleagues for informal discussions, or from participating in activities that they perceive as potentially attracting scrutiny. These effects undermine workplace culture, employee wellbeing, and the legitimate exercise of workplace rights.
Pre-Mitigation Assessment:
• Likelihood: Probable — the intrusion is inherent in the nature of the processing and occurs every time an individual enters the field of view of a facial recognition camera.
• Severity: Severe — the interference affects fundamental rights (Article 8 ECHR) and creates ongoing psychological and behavioural impacts.
• Pre-Mitigation Risk: High
Proposed Mitigation Measures:
• Clear and prominent signage at all entry points and camera locations, informing individuals that facial recognition is in operation.
• Comprehensive privacy notices provided to employees and available to visitors, explaining the purposes, lawful basis, and data subject rights.
• Limitation of facial recognition cameras to the most sensitive areas (12 of 47 cameras).
Residual Risk Assessment:
• Likelihood: Probable — signage and privacy notices do not reduce the occurrence of the intrusion; they merely inform data subjects that it is occurring.
• Severity: Severe — the intrusive nature of biometric identification is inherent in the technology and cannot be mitigated by transparency measures alone.
• Residual Risk: High
Assessment. The proposed mitigation measures are insufficient to reduce this risk to an acceptable level. Signage and privacy notices fulfil transparency obligations but do not reduce the severity or likelihood of the intrusion itself. The disproportionate nature of the processing is inherent and cannot be mitigated; it can only be addressed by not proceeding with the facial recognition component.
Risk 2: Algorithmic Bias and Discrimination
Risk Description. Facial recognition systems have been extensively documented, through independent academic research and regulatory investigations, as exhibiting higher error rates for certain demographic groups. In particular, multiple peer-reviewed studies (including the seminal 2019 NIST Face Recognition Vendor Test) have demonstrated that many facial recognition algorithms produce significantly higher rates of false positive and false negative matches for women, individuals from ethnic minority backgrounds, and older individuals, compared to white male subjects.
The deployment of such technology at Northgate Tower, which houses a diverse workforce including employees of multiple ethnicities, ages, and genders, creates a risk of discriminatory outcomes. Employees or visitors from demographic groups disproportionately affected by algorithmic bias may be subject to more frequent false alerts (being incorrectly identified as unauthorised or watchlisted), may experience more frequent challenges or stops by security personnel, and may suffer the indignity and distress of repeated misidentification. Such differential treatment has the potential to constitute indirect discrimination on the grounds of race, sex, or age, contrary to the Equality Act 2010.
The risk is exacerbated by the fact that NTP's proposed technology supplier, Veridian Security Technologies Ltd, has not provided independent, third-party bias audit results for its facial recognition algorithm. NTP has not been able to verify the algorithm's accuracy rates across demographic groups or to confirm that the algorithm has been trained on a sufficiently diverse dataset to minimise bias.
Pre-Mitigation Assessment:
• Likelihood: Probable — algorithmic bias in facial recognition technology is a well-documented phenomenon, and the absence of independent audit results for Veridian's algorithm increases the likelihood.
• Severity: Significant — discriminatory outcomes affect individuals' dignity, workplace experience, and equality rights, and may expose NTP to legal liability under the Equality Act 2010.
• Pre-Mitigation Risk: High
Proposed Mitigation Measures:
• Require Veridian to provide independent third-party accuracy testing results, disaggregated by demographic group.
• Require Veridian to confirm that the algorithm has been trained on a diverse dataset representative of the Northgate Tower population.
• Conduct regular bias audits of the system (proposed annually) during the Pilot period.
• Establish a complaints and review mechanism for individuals who believe they have been subject to biased outcomes.
Residual Risk Assessment:
• Likelihood: Probable — even with bias auditing, the complete elimination of algorithmic bias in facial recognition technology cannot be guaranteed with current technology. Bias may shift over time as the algorithm is updated or as the population composition changes.
• Severity: Significant — while auditing and complaints mechanisms may reduce the frequency and impact of bias, they cannot prevent discriminatory outcomes from occurring.