What happens when organisations try to use facial recognition for retail crime prevention without a proportionality assessment?

Without a proportionality assessment, organisations risk building a control that may not satisfy privacy regulators or public expectations, even if the intent is security. Facial recognition increases sensitivity because it involves biometric comparison against a watchlist. Teams need documented justification, clear limits, and an alternative response path when the privacy impact outweighs the security benefit.

Why the proportionality test matters before deploying facial recognition

Facial recognition for retail crime prevention is not just a technical control, it is a high-sensitivity surveillance measure that can affect lawful customers, staff, and bystanders. A proportionality assessment asks whether the security benefit is genuinely needed, whether less intrusive options would work, and whether the scope of collection, matching, retention, and escalation is narrow enough to be defensible.

That assessment is especially important because watchlist-based comparison changes the risk profile from ordinary CCTV to identity-based screening. Organisations should be able to explain why face matching is necessary for the stated purpose, what alternatives were considered, and how they avoid turning a narrow anti-theft measure into broad behavioural monitoring.

Where face recognition is being considered alongside broader AI governance, the compliance question is not only performance but also justification and oversight. The EU AI Act regulatory framework is a useful reference point for thinking about risk classification, documentation, and control expectations for higher-impact AI use cases.

What organisations usually get wrong

The most common failure is treating the system as if accuracy alone proves appropriateness. Even a technically accurate matcher can be an unsuitable control if the underlying collection and watchlist process is too broad, the consent or notice model is weak, or the result is likely to produce disproportionate friction for innocent people. In practice, the problem is often governance failure, not model failure.

Another mistake is assuming the existence of a retail loss problem automatically justifies biometric deployment. A proportionality test should force a decision on necessity, scale, audience, and fallback. If the same outcome can be reached through access control, store design, staffing, exception handling, or targeted non-biometric review, facial recognition may be hard to defend as the first-line option.

Retail teams also underestimate the operational burden of watchlist quality. False positives, stale records, poor image quality, and weak appeal or override processes can create repeated friction and erode trust. If the system cannot support prompt human review and a clear alternative path, the control can become harder to justify than the theft risk it is meant to reduce.

Risk and Threat Considerations

Without proportionality, the main risk is that the organisation deploys a control that creates privacy, governance, and reputational exposure disproportionate to the problem it is trying to solve. Facial recognition also concentrates risk because biometric data and watchlists are sensitive, harder to change than ordinary account data, and more likely to attract scrutiny from regulators and the public.

Failure mechanism: Over-collection, weak necessity analysis, or an overbroad watchlist can turn a targeted security measure into persistent identity surveillance, especially if the organisation cannot justify the scope, retention, and escalation rules.

Impact: The result can be regulatory challenge, customer trust loss, staff concerns, and a control that is difficult to sustain operationally even if it appears security-positive on paper.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST AI RMF, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the technical controls, while EU AI Act define the regulatory obligations.

Framework	Control / Reference	Relevance
EU AI Act	RISK-01 — Risk Management System	Facial recognition is an AI use case that needs documented justification and oversight.
Recommendation — Document necessity, limits, and human review before deploying the system.
NIST AI RMF	MAP — Map	Helps align the use case with intended purpose, context, and impact assessment.
Recommendation — Map the use case, affected parties, and impact before implementation.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	The deployment hinges on balancing security benefit against privacy and trust risk.
Recommendation — Set a risk acceptance decision that reflects both security and privacy impact.
CIS Controls v8	6 — Access Control Management	Watchlist-based facial recognition is a controlled access decision affecting who is flagged.
Recommendation — Restrict, review, and document the criteria used to trigger enforcement actions.
NIST SP 800-63	IAL — Identity Assurance Level	Biometric comparison raises assurance and evidence-quality considerations for identity decisions.
Recommendation — Use assurance requirements to bound how biometric matches are trusted and acted on.

Practitioner Guidance

What to verify: Confirm that the business objective, watchlist criteria, retention period, and human review process are documented before rollout. If any of those elements are vague, the control is not ready for real-world use, because the legal and operational burden comes from the decision path as much as from the matching engine.

Decision rule: If the proposed deployment cannot show why face matching is necessary rather than merely convenient, pause and redesign the control. If you can achieve the same loss-prevention outcome with materially less personal-data impact, that should usually be the default path.

What practitioners underestimate: Proportionality is not a paper exercise. It is the evidence trail that proves the organisation understood the trade-off, limited the scope, and built an alternative response when a match is uncertain or the privacy impact is too high.

Practitioner takeaway: Facial recognition in retail is easiest to defend when it is narrowly targeted, operationally reviewable, and backed by a clear necessity argument; without that, the security case can collapse even if the technology works.