What three core design questions must be answered when implementing a face-recognition / watchlist system?

Who can go on the watchlist (criteria), how many people to search at once (size), and what happens on a match (data release) — each with technical and legal implications.

Because face recognition inherently processes biometric data (subject to special data-protection rules), three fundamental questions shape what a system may legally do:

1. Watchlist criteria: When can someone be added? Criteria must be legally grounded, precisely defined, and documented — they determine the legitimacy of the whole system.
2. Watchlist size: How many people should be searched at once? The number of entries affects performance, accuracy, and resource needs; larger lists raise the chance of false matches.
3. Data release: What happens on a match? Processes for sharing, storage, notification, and deletion must be defined — affecting both technical workflows and legal compliance.

Tip: "Who's on the list" is the legitimacy question, "how big" is the accuracy question, and "what happens on a hit" is the accountability question — all three must be answered before deployment.