(GUF) WHEN SHOPS CANCEL YOU (PART 2)

If a supermarket is using facial recognition for identification, you are legally entitled to ask a clear and specific set of questions about that processing.

Under Articles 13, 14 and 15 of the UK GDPR, individuals have a right to transparency about how their personal data is used, particularly where high-risk biometric data is involved.

Article 13 applies where data is collected directly from you (for example, in-store facial capture). It requires the organisation to explain the purpose of processing, the legal basis relied upon, retention periods, and your rights.

Article 14 applies where data is obtained indirectly (for example via a watchlist or third-party system), and adds the requirement to explain the source of that data.

Article 15 establishes the Right of Access, commonly exercised via a Subject Access Request (SAR), allowing you to obtain confirmation that your data is being processed and meaningful details about how.

In simple terms, you are entitled to ask:

• What personal data they hold about you
• Why they’re holding it
• Where it came from
• Who it’s shared with (or the categories of recipients)
• How long they plan to keep it

These rights are not optional or discretionary — they are core GDPR obligations.

For clarity, where a shop captures biometric facial recognition data, a Data Protection Impact Assessment (DPIA) is mandatory. While the DPIA document itself may remain internal, the outcomes, risks, and safeguards cannot be hidden.

You are therefore fully entitled to ask questions such as:

• Has a DPIA been carried out for this facial recognition system?
• What key risks were identified?
• What safeguards were put in place as a result?
• Is biometric data stored, or merely processed transiently?
• Is it shared with third parties or suppliers?
• What human oversight exists?
• How can an individual challenge or object to the processing?

If an organisation refuses to answer those questions, that is a red flag, not because the DPIA itself must be disclosed but because UK GDPR requires meaningful transparency, particularly where biometric identification is concerned. More like this (GDPR) - link - more like this (digital ID) - link - more like this (supermarkets) - link