EU reaches deal on technical details of AI Act, biometric surveillance criticism remains

The European Union Artificial Intelligence Act entered its final stages last Friday as EU countries agreed on its technical details. The provisional agreement on the landmark legislation is now waiting for European Parliament committees’ approval. But while significant opposition is not expected, some legal experts are already warning about gaps in regulating remote biometric identification that could harm human rights.

“The AI Act only contains an in-principle prohibition on the use of such systems in publicly accessible places for law enforcement purposes, subject to complex conditions and exceptions,” writes Douwe Korff, Professor of International Law at London Metropolitan University.

In a legal analysis, Korff pointed out that there are areas within the final text of the Act that can be approved from a human rights perspective.

One of them is remote biometric identification systems developed and tested in real-world conditions in regulatory sandboxes. These systems are not required to have an impact assessment on fundamental rights nor do they need to be registered in a relevant database. This could create a loophole, allowing the use of such systems in an emergency, he writes.

Korff also criticized the AI Act’s stipulation to notify the relevant market surveillance authority and the national data protection authority when real-time biometric identification is used.

“The Act does not stipulate that this notification must happen at the same time as the request for authorization,” he writes. This may lead to law enforcement agencies only submitting the notification after the systems were already used. Moreover, authorities in charge of the supervision may not receive access to sensitive operational data

That does not appear to be a very effective form of oversight,” he says.

Will the AI Act change again?

The next step for the AI Act will be votes from the internal market and civil liberties committees, expected on February 13. The European Parliament is expected to formally approve the legislation on April 10 or 11. Once adopted, it would enter into force 20 days after publication in the official journal, EuroNews reports.

Privacy-minded lawmakers, however, may still introduce amendments, slowing down the expected timeline.

Uncertainty also remains on how the legislation will look once individual countries start implementing it. Recent media reports have suggested that some states have had reservations about the Act, including France, Austria, Germany and Italy.

The Friday agreement on the package was followed by a statement from the European Commission, reminding member states of their right to adopt more restrictive rules for technologies such as facial recognition, emotion recognition and biometric categorization.

The statement also introduced plans to set up an expert group comprised of authorities from EU member countries. The group will be tasked with advising and assisting the Commission in applying and implementing the AI Act, according to Politico.

The full text of the provisional agreement was published by the Council of the EU.

Article Topics

AI Act  |  biometric identification  |  biometrics  |  data protection  |  EU  |  facial recognition  |  legislation