The General Data Protection Regulation (GDPR) and its policing counterpart, the Law Enforcement Directive (LED) are the EU-wide rules on data protection. The GDPR clearly states that the processing of biometric data (which is an essential part of facial recognition systems) is in principle prohibited (Article 9), but may be allowed in certain, specific circumstances. This applies to all private and public authorities except police.

For the police, the LED applies. The LED states that the processing of biometric data is sensitive, and can only happen if it meets specific strict criteria, meaning that some uses are de facto prohibited. Anyone processing biometric data must also be aware of how it can impact upon other human rights that are enshrined in the EU Charter of Fundamental Rights, as well as international human rights law.

Despite a generally strong prohibition on processing biometric data in the GDPR, many providers continue to use the exceptions or margins of interpretation in the GDPR to deploy systems which are used in a way that amounts to mass surveillance. Dangerous systems are in use across the EU, with data protection authorities chasing after them to try to stop them. Legislative clarity is therefore urgently needed to make the prohibition of RBI in publicly-accessible spaces explicit, and to prevent the future legalisation of these rights-violating practices.

It is also notable that – due to concerns that biometric data may need to be more rigorously controlled – the GDPR (Article 9, paragraph 4) specifically foresees the addition of additional protections on sensitive biometric data. What’s more, the LED does not currently establish a clear prohibition on the processing of biometric data, despite the even greater risks when police use these systems.

The original proposal for an EU Artificial Intelligence Act in April 2021 proposed an in-principle ban on RBI, but with significant caveats and loopholes:

1. It banned ‘real-time’ (live) uses of RBI systems, but not the far more common ‘post’ uses. This means that authorities could use RBI after the data is collected (hours, days or even months after!) to turn back the clock, identifying journalists, people seeking reproductive healthcare, and more;
2. It only applied the ban to law enforcement actors (i.e. police). As a result, we could all still be surveilled in public spaces by local councils, central governments, supermarket owners, shopping center managers, university administration and any other public or private actors;
3. It also contained a series of wide and dangerous exceptions that could be used as a “blueprint” for how to conduct biometric mass surveillance practices – undermining the whole purpose and essence of the ban!

The draft law did not prohibit any other type of biometric system.

The distinction between ‘real-time’ biometric processing (the analysis happens live) compared to ‘post’ processing (the analysis happens at any point after the fact using previously captured inputs, most frequently by using CCTV footage) is largely a technical/procedural distinction relating to how the system has been set up.

In human rights terms, there is no salient difference between real-time and post RBI: the fear of being pervasively watched and tracked, the disincentivisation of peaceful protests and many forms of civic participation, the hesitation to express yourself and your identity. All of these rights and freedoms can be disproportionately curtailed when we are subjected to biometric mass surveillance. These threats are not reduced just because authorities or companies have extra time to review footage.

In some cases, the infringement on people’s rights and threat to democracy can be even worse when it comes to ‘post’ processing. The ability for governments, police, companies or malicious entitites to use your highly-sensitive personal data to see where you went, what you did, with whom you met etc over the course of weeks, months or even years, can have a profoundly damaging impact on people’s rights. Just imagine how much harder it would be for journalists to meet with sources, for people to feel comfortable accessing healthcare, legal advice or going to LGBTQI+ venues.

Common examples of biometric verification include unlocking your smartphone with your face, your iris or your fingerprint; or using a passport with a biometric chip to go through the ePassport gate at an airport. In both of these examples, there is no central database for this verification, and no-one else (not even the provider of the service) can access your biometric data.*

Your data are stored securely on your phone or in your passport’s smart chip, and never leave there. You must also have a genuine option to use an alternative (e.g. a PIN unlock or a human-operated passport control desk).

*Some providers or authorities may employ central checks outside of this biometric verification of passports. Such checks can have serious fundamental rights implications and are outside the scope of this blog.

A common example is police using a facial recognition device to check whether people walking down a street are on their watchlist of suspects. Another example is supermarkets putting facial recognition cameras around their stores to identify shoppers.

And although less frequent, biometric identification systems can be used for granting someone access to a space without the person needing to have a card with a chip – for example to give them so-called “seamless” access to events or train stations.

Biometric verification and identification are technical methods. Biometric authentication, however, is an outcome or a use for these methods, rather than a technical method itself. A provider wanting to ‘authenticate’ a person’s identity (see if they are authorised to access something or somewhere) would usually use biometric verification in order to perform that authentication.

However, the growing industry push towards ‘seamless solutions’ has led to an increase in the use of biometric identification techniques in order to authenticate people. Companies and governments do this by getting people to pre-enroll themselves in a database (e.g. by uploading a passport photo) so that they can then be identified without needing to present a chip, badge or other physical item. This is increasingly being done at sports events and travel hubs.

It’s worth being aware that some providers claim that their system is a biometric verification system when in fact at a technical level, what they are actually doing is biometric ‘identification’. They might also use the words ‘validation’, ‘authentication’ or ‘authentification’, when what they really mean is ‘biometric identification’. This seems to be a marketing tactic to try and falsely associate certain biometric systems to technical processes that are generally regarded as less risky.

• Your privacy can be disproportionately violated by the fact that you are being watched and treated as suspicious simply for going about your public life;
• Your data protection rights are invaded by the constant and disproportionate processing of your biometric data, often without proper knowledge and consent;
• Your data protection rights can also be can be violated by the unauthorised sharing of your sensitive data with third parties and the hacking of central databases;
• Your freedom of expression and association can be violated by the constant feeling of – or even just fear of – being watched, which is sometimes referred to as the ‘chilling effect’
• Your access to other rights (such as accessing healthcare and education, being involved in political activism, expressing your gender, sexuality, political affiliation or religion, or even participating in democratic processes like voting) can be made harder or suppressed;
• Your rights to equality and non-discrimination can be violated either through biases in AI systems leading to false identification or through the disproportionate deployment of these systems against minoritised and racialised people.

There are also security / practical risks that are intrinsic to how biometric identification works:

• Because they are stored in some central way, sensitive biometric data may be more likely to be exploited for commercial or surveillance purposes, either by the original processor, or by third parties;
• The likelihood that sensitive data can be hacked, breached or leaked increases; and
• The statistical likelihood of misidentification (e.g. false positives and false negatives) grows as the underlying databases grow.

Whilst the risks of BMS are not usually associated with biometric verification practices, there are some circumstances where this is not the case. When it comes to education and employment contexts, for example, there is a power dynamic that means that the use of even biometric verification could be an unacceptable violation of human rights. This has been confirmed by several data protection authorities in Europe. Moreover, when biometric verification systems are badly implemented, or are implemented without privacy-preserving features and safeguards, they can present just as great a threat to our rights.

When the EU’s proposed AI Act was first published in April 2021, the EDRi network (and many others) picked apart the ‘remote’ in RBI to see what it really means. There is no specific distance at which a use case becomes remote, and this is further complicated by the fact that some forms of biometric capture that traditionally required contact no longer do so. A good example is fingerprinting, which can now sometimesbe done remotely via a high quality photo or video.

Although it has been criticised as a term, our analysis has indicated that ’remoteness’ is, in fact, likely to be the best way of conveying what exactly it is that turns a use case from a potentially legitimate form of biometric processing to inherently harmful biometric mass surveillance. As such, we were glad when the Council of EU Member States decided not to oppose the use of the term ‘remote’.

We note that ‘remote’ appears elsewhere in the EU legal acquis, but it is important to remember that in the context of the AI Act, we are particularising the word ‘remote’ to the context of ‘biometric identification’. Therefore it isn’t directly equivalent to remote payments or other remote processes.

Whilst the risks of BMS are not usually associated with non-remote biometric identification practices, there are some circumstances where this is not the case. That’s why we use the term ‘usually’ here.

In particular, given the power imbalance and the context of criminalisation of migration, the use of non-remote biometric identification, such as fingerprint scanners and mobile facial recognition by law enforcement agencies, can lead to racial profiling and the infringement of right to non discrimination and other fundamental rights.

When we really interrogated the issue, we realised that ‘remoteness’ cannot be defined as a single thing, but rather a combination of factors that connote surveillance, whereby the surveilled individual(s) may in theory not know that they are being surveilled, and the system is able to scan more than one person.

In essence, it is a combination of physical distance and potential knowledge. This means that:

• If a person enrols for a facial recognition system using their laptop at home, and then turns up to an individual airport kiosk which automatically lets them through using their face, this would not be remote. No-one but the person at the kiosk would be scanned;
• But if that same person enrols for a facial recognition system using their laptop at home, and then turns up at the airport to find cameras installed on the ceiling which will flag anyone that didn’t pre-enrol, this would be remote. That’s because everyone at the airport would be scanned by these cameras, without the possibility to genuinely consent;
• If a company or authority used facial recognition software on a video of people at a public protest, this would be remote;
• If a person set up a home security system where they could use their fingerprint to get into their home using the technical process of identification, this would not be remote.

It’s a complex issue, and that’s why it is so important that the EU’s AI Act gets it right.

(b) the placing or making available on the market or putting into service of remote biometric identification systems that are or may be used in publicly-accessible spaces, as well as online spaces; and the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purpose of law enforcement, unless and in as far as such use is strictly necessary for one of the following objectives: [including the deletion of all subsequent paragraphs]

‘remote biometric identification system’ means an AI system for the purpose capable of identifying natural persons at a distance through the comparison of a person’s biometric data with the biometric data contained in a reference database or data repository, and without prior knowledge of the user of the AI system whether the person will be present and can be identified

The notion of ‘at a distance’ in Remote Biometric Identification (RBI) means the use of systems as described in Article 3(36), at a distance great enough that the system has the capacity to scan multiple persons in its field of view (or the equivalent generalised scanning of online / virtual spaces), which would mean that the identification could happen without one or more of the data subjects’ knowledge. Because RBI relates to how a system is designed and installed, and not solely to whether or not data subjects have consented, this definition applies even when warning notices are placed in the location that is under the surveillance of the RBI system, and is not de facto annulled by pre-enrollment.

(1)(d)(a). The use of private facial recognition or other private biometric databases for the purpose of law enforcement;

(1)(d)(b). The creation or expansion of facial recognition or other biometric databases through the untargeted or generalised scraping of biometric data from social media profiles or CCTV footage, or equivalent methods;