Prohibitions § 9.2.1

Biometric recognition technologies detect, capture, and transform measurable physical characteristics (such as eye distance and size, nose length, etc.) or behavioural characteristics (such as gait or voice) into machine-readable biometric data (see section 7.2.1.d) above). These data are available in different forms: images or templates, which are a mathematical representation of the salient features of an individual, used for recognition purposes. Biometric recognition technologies are used for verification and identification purposes.¹⁸⁵

According to Article 3(41) AI Act, a RBI system is [a]n AI system for the purpose of identifying natural persons, without their active involvement, typically at a distance through the comparison of a person’s biometric data with the biometric data contained in a reference database.

This definition covers only the identification functionality of biometric recognition systems, which implies the absence of active involvementof the persons concerned (i.e. no active participation) and results in the capture of the characteristics of those persons typically at a distance. For identification performance, the captured biometric data are compared with biometric data already stored in a reference database (such as a repository, e.g., a criminal database containing facial images or templates of suspects).

The notion of ‘biometric identification’ is defined in Article 3(35) of the AI Act as the automated recognition of physical, physiological and behavioural or psychological human features for the purpose of establishing the identity of a natural person by comparing biometric data of that individual to biometric data of individuals stored in a database.

Recital 15 AI Act further clarifies that such human features may comprise the face, eye movement, body shape, voice, prosody, gait, posture, heart rate, blood pressure, odour, keystroke characteristics,

AI systems used for following natural persons can also be included in the definition of biometric identification, for example to see in which direction a suspect escapes. This can be concluded from Article 5 (1)(h )(iii) AI Act, that allows for the localisation of suspects of crimes. The localisation is possible when a person is being followed.

AI systems that are intended to be used for biometric verification fall outside the scope of the prohibition in Article 5(1)(h) AI Act.¹⁸⁶ Biometric verification (or authentication) consists of comparing data presented at a sensor with another set of previously recorded data stored on a device, such as a smartphone, a passport , or an ID card. The purpose of biometric verification is to verify that a specific person is who they claim to be. An example of biometric verification is the comparison of a traveller’s face scanned at an e-gate with the facial image contained in their passport.

According to Article 3(41) AI Act, remoteness implies the ability of biometric systems to identify individuals without their active involvement, typically at a distance through the comparison of a person’s biometric data with the biometric data contained in a reference database.

The use of biometric systems to confirm the identity of a natural person for the sole purpose of having access to a service, unlocking a device, or having security access to premises is excluded from the concept of ‘remote’(Recital 15 AI Act). This modality is used, for example, in access control.¹⁸⁷ For example, a face identification system is deployed to enter a restricted area ( e.g., power plant premises) through face scanning technology; the system compares the face of the individual presented at the entrance c amera with a reference image contained in a reference database of persons allowed to enter the building.

Recital 17 AI Act clarifies that this exclusion from the scope of the prohibition is justified by the fact that such systems are likely to have a minor impact on fundamental rights of natural persons as compared to RBI systems which may be used for the processing of the biometric data of a large number of persons without their active involvement. That recital further clarifies that RBI systems are typically used to perceive multiple persons or their behaviour simultaneously in order to facilitate significantly the identification of natural persons without their active involvement. For active involvement, it is not sufficient that persons are informed about the presence of cameras, but they need to step actively and consciously in front of a camera that is installed in a way fostering active participation. For example,

• RBI systems that are used in cameras installed at walls or ceiling of metro stations for surveillance purposes. Such a system fulfils the condition of remoteness.
• Systems that are used to give access to the metro station , such as biometric metro tickets, where persons are actively involved and consciously approach the biometric sensor to obtain access, do not fulfil that condition.

Biometric recognition systems that process (contactless) fingerprints, gait, voice, DNA, keystrokes and other (biometric) behavioural signals may also constitute RBI systems.¹⁸⁸ For example,

• A voice biometric technology system may be deployed to identify a person speaking. The microphone then collects the biometric sample.
• A gait recognition system may be used via CCTV and the videos are automatically checked for matches with previously captured templates.
• Keystroke biometric technology may be used to identify the person typing a fraudulent message. The fact that these systems are given as examples of RBI systems does not imply that they are prohibited under Article 5 AI Act.

In the case of body-cams capable of RBI used by individual law enforcement agents, the untargeted filming during, for example , a demonstration with hundreds of participants will be considered to fulfil the condition of remoteness.

Identification is not possible without a reference database containing biometric data for comparison purposes. Thus, the existence of a reference database is indispensable to perform the comparison for identification purposes.¹⁸⁹ For example, in the case of missing persons, the Schengen Information System¹⁹⁰ database could be used as the reference database for facial recognition purposes (once operational).