Title: Your Face Isn't A Password
The Philippines’ National Privacy Commission has rolled out a risk-based framework that governs the collection and use of biometric data, putting facial-recognition systems under immediate regulatory scrutiny. Developers who build software that scans, stores or compares faces must now redesign pipelines, tighten audit trails and rewrite data-retention policies.
Why the shift matters
Until now, privacy impact assessments in the Philippines were checklist exercises—fill in a form, get a sign-off, move on. The new framework labels biometric data as high-risk by definition, especially when it identifies people in crowds. A leaked password can be reset; a compromised facial template cannot be changed, creating a permanent security liability. The commission’s guidance forces organisations to prove they have mitigated that risk before they start collecting images.
Facial recognition vs. facial comparison
The rules draw a clear line between two common uses of facial AI:
- Facial recognition – scanning a crowd and matching each face against a massive database. This is high risk.
- Facial comparison – checking two specific images against each other, such as opening a device with a selfie. This is lower risk and easier to justify during an audit.
What developers have to change
| Requirement | What it means for the codebase |
|---|---|
| Data-clearing hooks | Every module that captures or processes a face must include a built-in function to erase raw images, feature vectors and any derived data as soon as they are no longer needed. |
| Granular audit logs | Systems must record who accessed which biometric record, when, and for what purpose, down to the algorithmic decision that led to a match. |
| No indefinite storage | Biometric templates cannot sit in a database forever. Retention policies must define precise deletion windows and trigger automatic purge. |
| Explainable math | Teams must document similarity thresholds, the mathematical representation of faces (the “vectorization logic”), and the False Acceptance Rate (the chance an impostor is mistakenly accepted). |
| Pre-collection privacy assessment | Before any image is captured, a formal risk assessment must be completed and approved, integrating privacy engineering into the CI/CD pipeline. |
| Consent flows | Clear, opt-in mechanisms are required, with records of user permission stored alongside the biometric data. |
These changes go beyond a one-off audit checklist. They require privacy considerations to be baked into every stage of development, from model training to deployment and eventual decommissioning.