GLUKHIN v. RUSSIA JUDGMENT way. This is the case, for instance, with the possibility to access digital images of individuals on the internet. In order to prevent such infringements, the parties to Convention 108+ shall ensure that the development and use of facial recognition respect the rights to privacy and personal data protection, thereby strengthening human rights and fundamental freedoms by implementing the principles enshrined in the Convention in the specific context of facial recognition technologies. ... Lawfulness As provided for by Article 6 of Convention 108+, the processing of special categories of data, such as biometric data, shall only be authorised if such processing relies on an appropriate legal basis, and if complementary and appropriate safeguards are enshrined in domestic law. These safeguards shall be adapted to the risks involved and to the interests, rights and freedoms to be protected. In some legislation, the prohibition of such processing is a rule and its implementation is allowed only by way of exception, in certain specific cases (for example, with the explicit consent of individuals, to protect their vital interests or when the processing is necessary for reasons of overriding public interest), and subject to safeguards that are appropriate to the risks involved. The necessity for the use of facial recognition technologies has to be assessed together with the proportionality to the purpose and the impact on the rights of the data subjects. The different cases of use should be categorised and a legal framework applicable to the processing of biometric data through facial recognition should be in place. This legal framework should address, for each different use, in particular: - a detailed explanation of the specific use and the intended purpose; - the minimum reliability and accuracy of the algorithm used; - the retention duration of the photos used; - the possibility of auditing these criteria; - the traceability of the process; - the safeguards. Strict limitation of certain uses by law The level of intrusiveness of facial recognition and related infringement of the rights to privacy and data protection will vary according to the particular use and there will be cases where domestic law will strictly limit or even completely prohibit its use where that decision has been reached through the democratic process. The use of live facial recognition technologies in uncontrolled environments [the notion of ‘uncontrolled environment’ covers places freely accessible to individuals, which they can also pass through, including public and quasi-public spaces such as shopping centres, hospitals, or schools], in light of its intrusiveness on the right to privacy and the dignity of individuals, coupled with the risk of an adverse impact on other human rights and fundamental freedoms, should be subject to a democratic debate and the possibility of a moratorium pending a full analysis. ... 10