Civil Law and UAE Facial Recognition Misidentification Claims

1. Introduction

Facial recognition technology uses biometric information and artificial intelligence to compare a person's facial characteristics against images or databases.

A facial-recognition misidentification claim arises when a system incorrectly identifies one person as another and that error causes legally recognisable harm.

Examples include:

a person incorrectly identified as a wanted individual;

an innocent customer incorrectly matched to a fraud database;

a bank incorrectly rejecting a customer during digital identity verification;

an employee incorrectly identified as another person;

an airport or security system generating a false match;

an individual being denied access because of an erroneous biometric match;

an insurer or financial institution making an adverse decision based on an incorrect facial match; or

publication of an incorrect identification causing reputational or economic damage.

In UAE civil law, such a claim can potentially involve several bodies of law:

personal-data protection;

civil liability;

privacy;

electronic evidence;

contractual obligations;

professional negligence;

confidentiality;

consumer protection;

employment law; and

procedural rights.

A critical point is that UAE law does not presently contain a single comprehensive statutory cause of action called “facial-recognition misidentification.” The claim must normally be constructed from existing legal rights and liability principles.

2. Meaning of Facial-Recognition Misidentification

A facial-recognition system generally operates through a sequence such as:

Image capture → biometric extraction → mathematical comparison → similarity score → threshold → identification decision

A false identification can occur when:

Person A's image → algorithm compares it with Person B's biometric template → system produces a match → institution treats Person A as Person B.

This creates two separate questions:

Technological question

Was the system's identification accurate?

Legal question

What legal consequences follow from relying on an inaccurate identification?

The second question is the more important civil-law issue.

3. Types of Facial-Recognition Misidentification

A. False Positive

The system identifies an innocent person as another person.

Example:

A security database contains Person B's photograph. The algorithm incorrectly identifies Person A as B.

This is the classic misidentification case.

B. False Negative

The system fails to recognise the actual person.

Example:

Person B is authorised to access a facility, but the facial system fails to recognise B.

This can cause:

denial of service;

financial loss;

inconvenience;

reputational consequences; or

contractual loss.

C. Identity Substitution

The system associates a person's biometric information with another person's identity.

This is particularly serious because it can contaminate records.

D. Algorithmic Bias

Accuracy may vary between demographic groups or under different conditions.

Potential causes include:

training-data limitations;

image quality;

lighting;

camera angle;

demographic imbalance;

threshold selection; and

system design.

Scientific literature recognises false identification as a continuing legal problem because facial recognition is probabilistic and may be affected by algorithmic bias and its “black box” characteristics.

4. UAE Legal Characterisation of Facial Recognition Data

Facial recognition ordinarily involves information capable of identifying an individual.

The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, provides a general federal framework governing personal-data processing.

The law requires controllers and processors to implement appropriate technical and organisational measures and imposes obligations concerning protection and secure processing of personal data.

For facial-recognition systems, the important questions include:

What data is collected?

Why is it collected?

Is the purpose lawful?

Who controls the database?

Who processes the biometric information?

How long is it retained?

Who receives it?

Is it transferred outside the UAE?

How is accuracy maintained?

What safeguards exist against unauthorised disclosure?

What happens after a false match?

5. Accuracy as a Legal Issue

Accuracy is central to facial-recognition claims.

Suppose an organisation says:

“Our system produced a 97% confidence match.”

That statement does not necessarily establish legal responsibility.

The court may need to determine:

What does “97%” mean?

Is it probability of identity or similarity?

What was the error rate?

What threshold was used?

Was the image suitable?

Was the database accurate?

Were alternative matches considered?

Was human verification conducted?

Thus:

algorithmic confidence ≠ legal proof.

A high numerical score cannot automatically eliminate the claimant's right to challenge the result.

6. Potential Civil-Law Causes of Action

A UAE facial-recognition misidentification claim may potentially be structured around several legal theories.

6.1 Wrongful Processing of Personal Data

If biometric information is processed unlawfully or contrary to applicable requirements, the claimant may rely on data-protection rights and available statutory remedies.

6.2 Privacy Violation

If facial information is improperly collected, disclosed or used, the claimant may argue that the processing unlawfully interfered with protected personal interests.

6.3 Civil Wrong / Tortious Liability

Where an inaccurate facial identification causes legally compensable damage, general civil-liability principles may become relevant.

Potential damages include, depending on the facts and applicable law:

financial loss;

reputational harm;

consequential economic loss;

expenses incurred;

other legally recognised damage.

6.4 Contractual Liability

If facial recognition is used in a contractual relationship, for example:

banking;

insurance;

employment;

digital identity services;

access-control services;

the claimant may have a contractual claim if the service provider failed to perform its contractual obligations properly.

6.5 Professional Negligence

Where a professional or technology provider undertakes responsibility for identity verification, the question may become whether reasonable professional standards were followed.

7. Causation

Causation is one of the most difficult aspects of a facial-recognition claim.

A claimant generally needs to connect:

Facial-recognition error → institutional reliance → legally recognised damage

For example:

False facial match → bank blocks account → business transaction fails → financial loss.

The claimant must establish more than the existence of an inaccurate algorithmic result.

The court may ask:

Was the facial match actually wrong?

Did the defendant rely upon it?

Was the reliance a substantial cause of the harm?

Was there independent human verification?

Did another factor cause the loss?

Was the damage foreseeable and legally recoverable?

8. Human Verification and Shared Responsibility

A facial-recognition system may only produce a recommendation.

Suppose:

AI: “Match probability = 94%.”

Then:

Human officer: “I independently verify the identity.”

If the officer makes the final decision after examining additional evidence, responsibility may be different from a situation where:

AI: “Match.”

Institution: automatically arrests, excludes, terminates or refuses service.

Therefore, the legal analysis should distinguish:

AI-only decision

Algorithmic result directly produces the adverse consequence.

AI-assisted decision

Human decision-maker evaluates the result.

AI-triggered decision

AI triggers a process, but a human ultimately decides.

The degree of human involvement can be important to determining causation and responsibility.

9. Article 18 and Automated Decisions

An important UAE development is Article 18 of Federal Decree-Law No. 45 of 2021.

It provides a right to object in relation to certain decisions resulting from automated processing, including profiling, particularly where the decision has legal effects or significantly affects the data subject, subject to the law's exceptions.

This is highly relevant to facial recognition.

For example:

Facial recognition → automated identification → automated denial of service.

The claimant may therefore have a legal basis to challenge the automated processing depending upon the precise circumstances and applicable exceptions.

However, Article 18 should not be interpreted as creating an unrestricted right to invalidate every automated decision.

The statutory conditions and exceptions remain important.

10. Data Minimisation and Purpose Limitation

Facial recognition creates a risk of collecting more biometric information than is necessary.

For example, an organisation may collect facial data for:

“Building access.”

But later use the same data for:

employee monitoring;

behavioural analysis;

marketing;

law-enforcement profiling;

unrelated identification.

This raises a fundamental civil-law question:

Was the data collected for a lawful and sufficiently defined purpose, and is the later processing compatible with that purpose?

The UAE Personal Data Protection Law requires processing to be connected with the specified purpose and imposes obligations concerning retention and security.

11. Case Law 1 — DFSA v Commissioner of Data Protection & Anna Waterhouse

CFI 051/2018 and CFI 085/2018 — DIFC Courts

This is an important UAE-region data-protection authority.

The case concerned rights of access to personal data and the scope of information constituting personal data.

The DIFC Court considered whether information processed through automated systems could constitute personal data and examined the individual's ability to obtain information concerning processing.

Relevance to facial recognition

Facial-recognition systems operate through automated processing.

The case demonstrates an important principle:

Automated processing does not remove the legal significance of information concerning an identifiable person.

For facial recognition, this supports examination of:

what information was processed;

whether it relates to the claimant;

why it was processed;

its source; and

how the processing affected the individual.

Limitation

This is a DIFC data-protection case, not an onshore UAE Federal Supreme Court decision.

12. Case Law 2 — DFSA v Commissioner of Data Protection & Anna Waterhouse, 2020 Judgment

The later judgment in the same proceedings considered the statutory appeal and judicial-review issues concerning data-access rights.

The Court analysed the statutory framework governing personal-data processing and access rights.

Facial-recognition significance

A claimant challenging a facial-recognition decision may need access to sufficient information to establish:

that facial data was processed;

how it was processed;

the purpose of processing;

relevant information about the data;

and potentially whether the information was accurate.

This provides an important conceptual foundation for contestability of automated identification.

13. Case Law 3 — Al Ramz Capital LLC v Dubai Financial Services Authority [2025] DIFC CFI 087

This case concerned a regulatory/privacy decision and an application for permission to appeal.

The DIFC Court considered the procedural framework surrounding a privacy-related regulatory decision and refused permission to appeal.

Facial-recognition significance

The case demonstrates that privacy-related disputes can generate judicial review and appellate questions rather than being treated simply as technical data-management problems.

For facial recognition, this reinforces the importance of:

lawful processing;

regulatory compliance;

procedural fairness;

documentary evidence; and

judicial review mechanisms.

14. Case Law 4 — Shufti Pro Digital ID Verification Services Ltd v Ahmad Jamal [2025] DIFC CFI 079

This case concerned a digital identity verification company.

The DIFC Court dealt with a dispute involving a company providing digital identification services. Although the reported order concerned procedural matters and default judgment rather than a substantive finding of facial-recognition liability, the case is particularly relevant because it demonstrates that digital identity verification businesses can become directly involved in civil litigation before UAE-region courts.

Facial-recognition significance

The case is useful for understanding potential defendants in a facial-recognition dispute, including:

identity-verification providers;

technology companies;

service providers;

customers using verification technology.

Important limitation

The case should not be cited as holding that Shufti Pro committed facial-recognition misidentification. The reported order did not establish such liability.

Its value is contextual and procedural rather than a direct precedent on false facial matching.

15. Case Law 5 — Atul Ashok Amir Chand Dhawan v Zurich International Life Limited [2025] DIFC CFI 019

This case concerned alleged confidentiality and financial losses in connection with an insurance policy.

The DIFC Court ultimately held that it lacked jurisdiction over the proceedings.

Facial-recognition significance

The case illustrates an important threshold issue:

Before considering whether facial recognition caused wrongful damage, the claimant must establish that the selected court has jurisdiction.

A facial-recognition claim might involve:

an onshore UAE entity;

a DIFC entity;

an ADGM entity;

an international technology provider; or

a cross-border data processor.

Therefore, jurisdiction can become a preliminary issue.

16. Case Law 6 — Techteryx Ltd v Aria Commodities DMCC & Others [2025] DIFC DEC 001

The DIFC Digital Economy Court's proceedings in Techteryx concern complex digital-asset disputes and illustrate the courts' ability to apply traditional civil remedies to technologically sophisticated disputes. The Digital Economy Court continues to deal with the matter through 2026.

Facial-recognition significance

The case demonstrates that digitalisation does not automatically create a separate legal universe.

Traditional remedies involving:

property;

disclosure;

tracing;

injunctions;

banking relationships; and

judicial supervision

can operate in technologically complex environments.

The same reasoning can apply to biometric disputes.

17. Case Law 7 — DFSA v Commissioner of Data Protection & Anna Waterhouse: Personal-Data Principle

The Waterhouse litigation is particularly valuable because the DIFC Court examined the concept of personal data in an automated-processing environment.

The Court recognised that not every item of information retrieved through a search concerning an individual necessarily constitutes that person's personal data; the relationship between the information and the individual must be considered.

Facial-recognition application

This is important because a facial-recognition database may contain:

images;

metadata;

match scores;

identity labels;

associated records.

The claimant must identify what information legally constitutes their personal data and how it was processed.

18. Case Law 8 — Shufti Pro and the Digital Identity Context

Shufti Pro Digital ID Verification Services Ltd v Ahmad Jamal is particularly useful as a modern UAE-region authority because the claimant was a digital identity verification company.

The case demonstrates the growing judicial relevance of companies operating identity-verification infrastructure.

However, a legally careful analysis must distinguish:

digital identity litigation

from

a judicial finding of facial-recognition misidentification.

There is currently a limited reported UAE case law directly deciding the latter.

That limitation should be expressly acknowledged in legal research.

19. Is There a Direct UAE Facial-Recognition Misidentification Precedent?

At present, there is no substantial body of reported UAE Federal Supreme Court case law specifically deciding a civil damages claim caused by an erroneous facial-recognition match.

This is legally significant.

It means that an argument such as:

“UAE courts have already established that facial-recognition misidentification automatically creates civil liability”

would be too broad.

The better approach is to construct the claim from established principles involving:

personal-data protection;

unlawful processing;

civil damage;

causation;

privacy;

contractual obligations;

negligence;

evidentiary reliability; and

automated decision-making.

The Waterhouse data-protection litigation and the newer digital-identity cases provide useful UAE-region context, but they should not be presented as direct false-match precedents.

20. Facial Recognition and the Burden of Proof

A claimant may face an information asymmetry problem.

The technology provider may possess:

source images;

biometric templates;

confidence scores;

system logs;

training information;

threshold settings;

audit records;

human-review records.

The claimant may possess only:

“The system said I was someone else.”

This creates a practical evidentiary difficulty.

A fair litigation framework may therefore require careful examination of:

system records;

audit trails;

database provenance;

image quality;

match thresholds;

human intervention;

system accuracy;

alternative identification evidence.

The court should avoid treating an unexplained algorithmic output as conclusive proof.

21. Facial Recognition and Expert Evidence

A facial-recognition dispute may require technical expert evidence.

An expert might be asked:

Was the system technically reliable?

Was the image adequate?

What was the false-positive rate?

Was the threshold appropriate?

Was the database properly configured?

Was the algorithm independently validated?

Could environmental factors explain the error?

Was the result reproducible?

But the expert should not normally determine the ultimate legal issue.

The distinction is:

Expert: “The system produced a false match.”

Court: “What legal responsibility follows from that false match?”

22. Algorithmic Bias

Bias is an important issue in facial-recognition litigation.

A claimant may argue that the system systematically produces higher false-positive rates under particular conditions.

However, a legal claim should be based on evidence rather than assumption.

The claimant may need evidence concerning:

testing methodology;

system performance;

relevant population;

sample size;

image quality;

operating conditions;

independent validation.

The existence of a general academic concern about facial-recognition bias does not, by itself, prove that a particular UAE defendant's system was discriminatory or defective. Scientific literature does, however, recognise algorithmic bias and probabilistic identification as important sources of misidentification risk.

23. Facial Recognition and Defective Technology

A facial-recognition claim can potentially be framed around technological defect.

Potential defects include:

Design defect

The system was inherently unsuitable for the intended purpose.

Manufacturing/implementation defect

The particular deployment was incorrectly configured.

Data defect

The database contained inaccurate information.

Operational defect

The system was improperly maintained.

Human-supervision defect

The institution failed to verify high-risk matches.

Security defect

Biometric information was improperly exposed.

Each theory requires evidence appropriate to the particular circumstances.

24. Facial Recognition and Data Security

Biometric information creates an unusually serious security problem.

A password can be changed.

A person's face generally cannot simply be replaced.

Therefore, unauthorised disclosure or compromise of biometric information can create continuing risks.

The UAE Personal Data Protection Law requires appropriate technical and organisational protection measures and places security-related obligations on processing operations.

A claimant may therefore distinguish between:

misidentification

and

biometric-data security breach.

They may arise from the same incident but involve different legal questions.

25. Facial Recognition and Reputation

Suppose a facial-recognition system incorrectly identifies an innocent individual as a criminal suspect.

Possible consequences could include:

detention;

exclusion;

public embarrassment;

employment consequences;

loss of business;

reputational injury.

The legal analysis must distinguish between:

Internal false identification

The error remains within the organisation.

External disclosure

The false identification is communicated to third parties.

Public dissemination

The allegation becomes publicly available.

The wider the disclosure, the more significant the potential reputational consequences may become, subject to the applicable UAE legal framework.

26. Facial Recognition in Banking and Financial Services

Banks increasingly use digital identity verification.

A false facial match could lead to:

account blocking;

transaction refusal;

onboarding rejection;

compliance escalation;

delayed payments.

The claimant may potentially rely on:

contractual obligations;

banking duties;

data-protection rights;

evidence of financial loss;

procedural fairness where applicable.

However, financial institutions may also have statutory and regulatory obligations requiring identity verification and anti-money-laundering controls.

Therefore, a bank's use of facial recognition cannot be assessed in isolation.

The court may need to balance:

identity-verification obligations

against

accuracy, proportionality and individual rights.

27. Facial Recognition in Employment

Employers may use facial recognition for:

attendance;

access control;

identity verification;

workplace security.

A false identification may result in:

incorrect attendance records;

disciplinary action;

denial of access;

employment consequences.

The employee could potentially challenge the accuracy and legality of the processing.

The employer should ideally have mechanisms for:

correction;

human review;

verification;

record correction; and

appeal against an automated identification.

28. Facial Recognition and Automated Decision-Making

The most serious situation is:

Facial recognition → automated decision → legal/economic consequence

For example:

Facial match → automated fraud classification → account termination.

Here the issue is no longer merely whether the photograph was correctly matched.

The legal issue becomes:

Can a consequential decision be made substantially through an automated process, and what rights does the affected person have to challenge it?

Article 18 of the UAE Personal Data Protection Law is therefore particularly relevant to qualifying automated decisions.

29. Facial Recognition and Human-in-the-Loop Requirements

A useful safeguard is:

AI match → human verification → adverse decision

rather than:

AI match → automatic adverse decision

Human review is particularly important where the consequence is serious, such as:

detention;

termination;

denial of essential financial services;

blacklisting;

major financial loss;

reputational accusation.

Human review should be meaningful rather than merely formal.

A person who simply clicks:

“Confirm AI result”

without reviewing the evidence may not provide genuine independent verification.

30. Damages

Where liability is established, the question of damages becomes important.

Potential categories can include, depending on applicable law and proof:

Economic loss

lost transactions;

lost employment income;

additional expenses;

business interruption.

Non-economic injury

Potentially including recognised forms of personal or reputational harm where recoverable under the applicable UAE legal regime.

Remedial relief

A claimant may also seek appropriate non-monetary relief, depending upon the cause of action and court jurisdiction, such as:

correction of records;

cessation of unlawful processing;

deletion where legally required;

disclosure;

injunction;

correction of inaccurate information.

31. Defences Available to Technology Providers

A technology provider may argue:

1. No causal connection

The system produced an output, but the defendant did not make the adverse decision.

2. Human decision-making

A trained employee independently evaluated the result.

3. Lawful processing

The processing was authorised by law or another applicable legal basis.

4. Regulatory obligation

The defendant was required to perform identity verification.

5. Claimant's loss is unproven

The claimant cannot establish legally compensable damage.

6. Third-party fault

Another institution made the final decision.

7. Contractual allocation of responsibility

The contract may allocate particular risks between parties, subject to mandatory law.

These defences demonstrate why the existence of an inaccurate facial match alone does not automatically establish civil liability.

32. Key Legal Questions for a UAE Court

A court considering a facial-recognition misidentification claim could logically ask:

Was facial data processed?

Who was the data controller?

Who was the processor?

What was the purpose?

Was the processing lawful?

Was the information accurate?

Was the algorithm sufficiently reliable?

Was the claimant actually misidentified?

Did a human verify the result?

Who made the final adverse decision?

Was the claimant informed?

Could the claimant challenge the decision?

Was there a breach of a contractual or statutory duty?

Did the error cause legally recognised damage?

What remedy is legally available?

33. Comparison of Different UAE Jurisdictions

A DIFC or ADGM case should therefore not be presented as binding precedent of the UAE Federal Supreme Court.

34. Important Distinction: Misidentification vs Misuse

There are at least two separate claims.

Misidentification

“The system incorrectly identified me.”

Misuse

“The organisation lawfully identified me but used my biometric information for an unauthorised purpose.”

A single case may involve both.

For example:

Facial scan → false match → information sent to third party → financial loss.

This potentially involves:

accuracy;

lawful processing;

disclosure;

causation; and

damages.

35. Relationship Between Facial Recognition and Civil Liability

The basic analytical structure can be expressed as:

Duty

↓

Facial-recognition processing

↓

Error / unlawful processing

↓

Reliance

↓

Damage

↓

Causation

↓

Remedy

The claimant must establish the relevant components under the particular legal cause of action.

36. Emerging Doctrine: Algorithmic Duty of Care

Facial-recognition technology may gradually encourage courts to examine whether organisations have exercised reasonable technological care.

This may include:

system testing;

accuracy monitoring;

threshold selection;

human verification;

cybersecurity;

record correction;

incident response;

vendor oversight.

The emerging concept can be described as:

Algorithmic duty of care = reasonable care in designing, deploying, supervising and relying upon automated identification systems.

This should be treated as a developing analytical concept rather than as an already established independent UAE cause of action.

37. Emerging Doctrine: Algorithmic Contestability

A person incorrectly identified by AI should, where applicable, have a meaningful opportunity to challenge the result.

This requires:

Identification → Notification → Explanation → Challenge → Human Review → Correction

Without contestability, an algorithmic mistake can become self-reinforcing.

For example:

Facial system incorrectly identifies A → database records A as B → subsequent system searches database → second system confirms first system's record.

The original error becomes “evidence” for later decisions.

This is known as a feedback-loop problem.

38. Emerging Doctrine: Data Accuracy

Facial-recognition systems demonstrate that accuracy is not merely a technical issue.

If inaccurate biometric information produces a legal consequence, accuracy becomes a legal issue.

The organisation should therefore be able, where required, to demonstrate:

data provenance;

reliability;

correction mechanisms;

appropriate security;

appropriate retention;

meaningful review.

39. Six Core Case-Law Principles for Examination

The authorities discussed above can be reduced to six major principles:

1. Waterhouse — Personal-data access and automated processing

Individuals may have legally relevant rights concerning information processed about them.

2. Al Ramz Capital — Privacy and regulatory review

Privacy-related decisions can be subject to formal judicial and regulatory processes.

3. Shufti Pro — Digital identity verification

Digital identity businesses can become parties to civil litigation in the UAE-region courts.

4. Dhawan v Zurich — Jurisdiction

A claimant must establish that the selected court has jurisdiction before the merits can be determined.

5. Techteryx — Digital disputes

Traditional civil remedies can be applied to technologically sophisticated disputes.

6. Waterhouse 2020 — Data-processing rights

Automated processing does not eliminate the legal significance of personal-data rights.

40. Practical Compliance Model for UAE Facial-Recognition Operators

A responsible facial-recognition system should ideally incorporate:

Before deployment

lawful purpose;

necessity assessment;

accuracy testing;

bias testing;

security assessment;

data-governance controls.

During deployment

quality controls;

monitoring;

appropriate thresholds;

human verification for high-impact matches;

audit logs.

After an alleged false match

immediate investigation;

preservation of logs;

human review;

correction of inaccurate records;

notification where legally required;

assessment of resulting harm.

41. Conclusion

Facial-recognition misidentification presents a developing civil-law problem in the UAE.

The central legal difficulty is that the technological error and the legal wrong are not necessarily identical.

A false algorithmic match becomes a civil claim only when the applicable legal requirements concerning:

unlawful processing;

breach of duty;

causation;

damage;

contractual responsibility;

privacy; or

another recognised legal basis

are established.

The UAE Personal Data Protection Law is particularly important because it regulates personal-data processing, imposes security and governance obligations, and recognises rights concerning certain automated decisions.

The DIFC's data-protection litigation demonstrates that automated processing can generate enforceable legal rights concerning personal information. Modern digital-identity litigation, including Shufti Pro v Ahmad Jamal, shows the increasing relevance of identity-verification technology to UAE-region civil proceedings.

However, the present reported authorities do not establish a general rule that every facial-recognition false positive automatically creates civil liability.

The most defensible legal framework is therefore:

Facial-recognition error + unlawful/defective processing or breach of duty + reliance + causation + legally recognised damage = potential civil liability.

Short Exam Formula

Facial Misidentification = Biometric Processing + Accuracy Duty + Human Verification + Causation + Damage + Remedy

The emerging UAE approach is consequently not to treat facial recognition as inherently unlawful, but to require that its use remain consistent with lawful processing, data protection, accuracy, accountability, security, contestability and established civil-liability principles.