Hacker News Reader

Comment by breakingcups | Hacker News Reader

That's just bizarre. This would never, ever, fly under the GDPR.

it would actually, biometric ids etc are allowed for various regulated reasons -- identifying folks who cross national boundaries is likely one of them

I’ve used similar systems recently in Europe so it would appear GDPR is cool with it...

It seems they are simply asking for identify verification by sending the photo to a remote DHS server for verification. How is this different than showing a ticket agent your passport and having them scan it? That’s the same photo in question. GDPR doesn’t get you out of having to verify your identity in person against a government photo for boarding a flight.

In fact, one could argue the method in question is actually more secure and private because you never actually have to share your passport photo directly with JetBlue.

Implying that European states would pass laws that limited their power over the cizitenry.

I believe that if you study the language of the GDPR, you'll find that "it's OK if the government does it."

In this case since the company does not store the images GDPR doesn’t apply.

Even if they don't retain the images, it's a veritable treasure trove for security agencies, who will almost certainly be hoovering them up, either with or without the company's knowledge.

It's been a few years since I traveled international - but CBP already takes pictures at passport control, don't they?

I have never had my picture taken while leaving the United States, which is what this sounds like. Arriving? Sure.

You have not had this knowingly. You have not posed for a photo.

But surely, the government has plenty of cameras in customs areas and face recognition has been a thing for a decade.

Now think about the attributes they're recording from your phone when you approach.

You don't go through customs areas to leave the US, though.

Maybe the TSA does it, of course.

Doesn't the GDPR also apply to entities that process personal data (as opposed to only those that store it)?

AFAIK it should apply to entities that share personal data with third parties, for instance.

If I am understanding this correctly this would be ok under the GDPR because the government is the one holding the data bag.

They got the images from CBP.

Are you sure? According to what the airline said, the airline doesn't have the facial recognition data; rather they are just taking photos from passengers who opt in to board via this method, and the photos only need to be stored for a few seconds so they can be sent to DHS for verification.

The airline isn't taking or storing photos of passengers who don't opt into this process, but it is presumably sending the government a list of all passengers prior to boarding so that photos of passengers who opt in can be verified. Would this violate the GDPR?

> According to what the airline said, the airline doesn't have the facial recognition data

I absolutely do not believe the tweets from a company PR representative as to how their technology actually works.

Regardless of whether this PR person knows anything or not, I think the much more likely scenario is that they are sending facial recognition requests to a CBP API vs. building their own facial recognition database with 100s of millions of identities out of thin air.

But they have your photo after they take it, and the CBP verifies for them who you are. From this information transfer, the airline can replicate the CBP database entry for each person that it takes a picture of... In the long run, they can build a facial recognition database of everyone who flies. Am I wrong about this?

No, but whether they actually are or not is another question.

They could also build the same database 10 years ago by taking your picture as you scanned your boarding pass.

I haven't done international travel (by normal means), have they always taken your picture for that? Thanks for the info!

No, but they could surreptitiously take your photo if they wanted to. I doubt there is much expectation of privacy at an airport gate

If the database of photos has a business value then they will be looking for loopholes to store them. It would be stupid to spend money on new equipment and not maximize the returns.

do you actually believe that the twitter PR person has enough technical knowledge of this process to make such bold claims as to whether they store people's data or not? And if you do believe they would have enough knowledge, do you believe they would EVER tell the truth?

I believe the PR person have the knowledge by proxy, someone is directing him. I also believe that DHS won't give them sensitive information without requiring them to conform to the relevant regulations.

I can't say I'm certain it is fail-proof, and it defiantly can feel spooky but not everybody is lying to you all the time.

From the article the PR quoted, I arrived to the relevant executive order that facilitated this, section 8: https://www.whitehouse.gov/presidential-actions/executive-or...

The government already sees all the flight manifests. Assuming that it also has a database of photos from passports, the matching process doesn't violate anyone's privacy, since they opted in to have their photo matched in the first place.

s/who opt in/who don't opt out/ according to the tweets.

But you're right, and the process is surprisingly reasonable as long as the implementation is safe

Driver's licenses surely have photos still in EU nations, right? I don't think the GDPR speaks to this.

Reply on news.ycombinator.com