European Parliament draws red line against biometric surveillance society

Thanks to the vote, this stance becomes the official position of the European Parliament, and will be taken forward in the final stage of legislative negotiations with EU member state governments. If they can achieve consensus, the EU could have an approved Artificial Intelligence Act (AI Act) as early as this winter.

Lead negotiators agreed five key prohibitions to stop BMS

Earlier in 2023, lead Members of the European Parliament (MEPs) in the internal markets and civil liberties committees brokered a draft deal which would ban several of the most harmful uses of AI systems which process biometric data. This deal is what was approved in the vote on the 14 June.

This deal – agreed to by MEPs from all seven of the Parliament’s political groups – saw a total ban on the use of real time (aka live) public facial recognition and other biometric identification – like using people’s eyes or walking pattern (gait) to identify them – in public.

The next ban was on retrospective deployments and uses in general, but with a carve-out for police, if they have judicial authorisation. Third, they banned the sale, deployment or use of systems which process biometric data – even if it doesn’t uniquely identify people – in order to categorise them based on skin colour, gender, or other sensitive characteristics; and fourth, the sale to, deployment or use of AI systems by police, border authorities, employers or educational authorities, to profile or predict people’s emotions. Lastly, they banned the use of scraping tools to build or expand facial recognition databases (think: Clearview AI).

These five prohibitions would stop many of the public biometrics use cases that have been linked to human rights violations around the world – while allowing uses like phone unlocking or forensics to continue.

Use cases that fell outside the bans were made high risk: all residual biometric identification, categorisation or emotion recognition would have to follow the Act’s rules to protect human rights and safety from risky uses of AI.

The limits of the red lines on BMS

This deal from the Parliament built on the approach that had originally been put forward by the European Commission in 2021. EDRi has criticised the Commission for explicitly recognising the risks of these systems, but failing to go far enough to protect us from them. As the deal outlined above shows, the Parliament listened closely to all of our demands.

However, there were still areas where they did not go far enough – likely a sign of the need to achieve agreement across the political spectrum. For example, we had encouraged the Parliament to recognise that retrospective facial recognition can be just as harmful as live versions, and were disappointed not to see a full ban on post uses in their deal.

The same logic applies to emotion recognition systems, which were banned in the Parliament’s deal in some of the most harmful sectors due to being incredibly intrusive, discriminatory and based on flimsy pseudo-scientific assumptions. But by this logic, it seems incoherent to allow them in other areas. There are also open questions about the extent to which people in migration contexts are protected by the prohibitions. Whilst one of the leads, MEP Dragos Tudorache, has argued that people on the move are protected, we fear that in fact, the AI Act largely does not tackle the broad range of harmful uses of AI at the EU’s borders.

Notably, only uses of biometrics that have a specific “artificial intelligence” component were in the scope of this law. This meant, for example, that the AI Act for the most part cannot address the problems with underlying biometric infrastructures such as databases, which have also been implicated in human rights violations – in particular discrimination against people on the move. That’s why at EDRi we continue our work on the Prüm II Regulation, EURODAC and more, in order to address these other systemic issues and injustices which relate to biometric data.

A historic vote as the Parliamentary majority agrees with the ban

The vote on 14 June asked the full 705 MEPs to decide whether to adopt, amend or reject the deal that had been reached in the committee. A last-minute attempt by the center-right European People’s Party (EPP) to remove or water down the bans on public facial recognition – citing vague and un-evidenced claims of public safety – was fortunately unsuccessful. According to press reports, this is part of a bigger trend of the EPP group trying to appeal to their Conservative base ahead of the 2024 EU elections – even though it meant reneging on the deal to which their colleagues had agreed.

On the other hand, attempts to generally strengthen the human rights protections in the AI Act beyond the committee position, for example to prevent digital pushbacks of people on the move, to mandate accessibility requirements, or to ensure stronger fundamental rights impact assessments, were also not approved. These were some of EDRi’s core demands, and we are disappointed that they were not taken into the final report.

A push by several lawmakers to extend the biometrics bans to the sort of behavioural profiling that France is trying to enact for the 2024 Paris Olympics and Paralympics was also unsuccessful, by a relatively small margin of 27 MEPs.

This means that the official Parliament position as adopted was word-for-word what had been agreed in the committees a month prior — following 1.5 years of intense negotiations. 499 MEPs voted overall in favour of the final report, but as several of the biometrics parts were voted on separately, the margin of success for the BMS votes varied. The closest gap was a majority of 38 MEPs, whilst the largest was a 94 MEP majority. This was neither a knife-edge, nor a landslide.

The final leg of the negotiations for an EU AI Act

Almost as soon as the vote had finished, lead MEPs met with representatives of the Council of EU member states to begin their negotiations, known as “trilogues”. This is the process by which the Parliament and the Council, as the EU’s “co-legislators”, and supported by the European Commission, will try to reach an agreement on a final law.

When it comes to biometrics, the delta between the negotiating institutions is vast. What’s more, several EU member states have spoken out to say they will not accept bans on biometric identification. That makes the future of biometrics in the AI Act deeply uncertain.

The original legislative proposal from the European Commission was criticised by Europe’s top data protection supervisor, the EDPS, for being too permissive on the issue of biometric surveillance. Whilst the Commission billed its proposal as narrow and allowing public facial recognition only in exceptional circumstances, the reality was that they had presented a blueprint for the use of these technologies.

Their draft would have permitted facial recognition cameras on every street to look for crimes including smuggling exotic plants – hardly the ‘exceptional use’ that they claim. Even seemingly more narrow use cases, such as counter-terrorism or searching for missing children, are in fact very broad: as the EDPS points out, these examples are routinely used by police to justify near-permanent surveillance. Other practices, such as categorisation, were given only feeble transparency requirements by the Commission. It’s likely they will continue to push for this in the trilogues.

The official position of the Council of the EU went even further than the Commission, expanding the exceptions and weakening the safeguards. This demonstrates a clear appetite from EU governments to make the permanent biometric surveillance of our societies – when we go to bars, places of worship, and protests, when we cross borders or go to school – a reality.

Given this, the European Parliament will be like David against the Goliath of the Council, propped up by a security industry which claims – despite a total lack of public evidence – that these systems keep us safer. On the other hand, the governments of both Austria and Germany have openly disagreed with the Council’s proposed wide use of biometric surveillance systems, with certain other countries also remaining sceptical.

Can the Parliament’s strong position, the dissenting views of several member states, and the growing public opposition to biometric mass surveillance be enough to sway the outcome? Only time will tell, but one thing seems clear right now – any exception to the ban will be like creating a mass surveillance roadmap. For this reason, the EDRi network and Reclaim Your Face campaign will continue fighting against all laws and practices that treat us as walking barcodes, and for the full respect of our human rights in the digital age.