‘The categorisation of an individual by a biometric system is typically the process of establishing whether the biometric data of an individual belongs to a group with some pre-defined characteristic. It is not about identifying an individual or verifying their identity, but about assigning an individual to a certain category. For instance, an advertising display may show different adverts depending on the individual that is looking at it based on the ir age or gender.’175 Persons may also simply be categorised for statistical reasons , without being identified and without the objective to identify them.
Article 3(40) AI Act defines a biometric categorisation system as an AI system for the purpose of assigning natural persons to specific cat egories on the basis of their biometric data, unless it is ancillary to another commercial service and strictly necessary for objective technical reasons. As explained in section 7.2.1.d), ‘biometric data’ is defined in Article 3(34) AI Act . In particular, biometric data comprises behavioural characteristics that are based on biometric features. The scope of biometric categorisation excludes categorisation according to clothes or accessories, such as scarfs or crosses, as well as social media activity.
Biometric categorisation may rely on categories of physical characteristics (e.g., facial features and form , skin colour) based on which persons are assigned to specific categories. Some of these categories may be of a special ‘sensitive’ natureor ’ characteristics protected under Union non-discrimination law, such as race. However, biometric categorisation may also be based on DNA or on behavioural aspects, such as keystroke analysis or a person’s gait.176
To fall outside the scope of the definition of biometric categorisation under the AI Act, two conditions – being ‘ancillary to another commercial service and strictly necessary for objective technical reasons’– must be cumulatively fulfilled.
According to recital 16 AI Act, a purely ancillary feature is a feature that isintrinsically linked to another commercial service, meaning that the feature cannot, for objective technical reasons, be used without the principal service, and the integration of that feature or functionality is not a means to circumvent the applicability of the rules of the AI Act. For example, the following uses of AI are permitted under Article 5(1)(g) AI Act:
- Filters categorising facial or bod ily features used on online marketplaces to allow a consumer to preview a product on him or herself could constitute such an ancillary feature, since they can be only used in relation to the principal service which consists in selling a product.
- Filters integrated into online social network services which categorise facial or bodily features to allow users to add or modify pictures or videos could also be considered to be ancillary feature, since such a filter cannot be used without the principal service of the social network services consisting in the sharing of content online. In contrast, examples of uses that would be prohibited include:
- An AI system that categorises persons active on a social media platform according to their assumed political orientation, by analysing the biometric data from the photos they have uploaded on the platform , to send them targeted political messages. While such a system may only be ancillary to the political advertising, it would not be ‘strictlynecessary for objective technical reasons’, hence the conditions for excluding it from the definition of biometric categorisation are not fulfilled.
- An AI system that categorises persons active on a social media platform according to their assumed sexual orientation by analysing the biometric data from photos shared on that platform and on that basis serves those persons advertisements would qualify as biometric categorisation within the meaning of the AI Act . Also in this case there is no strict necessity for this ‘ancillary service ’, hence the exclusion from the prohibition does not apply.