The use of AI for biometric identification has sparked many concerns, especially in the view of potential human rights abuse. First and foremost, biometric identification, especially facial recognition, involves capturing and analyzing personal data which raises data protection concerns. Many critics suggest that AI algorithms used in biometric identification systems may not be completely accurate and can sometimes exhibit bias. There have been instances where these systems show higher error rates for certain demographic groups, particularly women and people with darker skin tones. This raises concerns about unfair treatment and discrimination.
The deployment of AI for biometric identification also raises questions about civil liberties. Opponents argue that constant surveillance and identification can lead to a chilling effect on freedom of expression and assembly, as individuals may alter their behavior due to the awareness of being constantly monitored. When governments use AI for mass surveillance purposes, it raises concerns about the erosion of civil liberties and the potential for abuse of power. Citizens may worry about being constantly monitored, leading to a debate over the balance between security and individual freedoms.
As a result, there are ongoing debates worldwide about the ethical and legal implications of using AI for biometric identification, leading to calls for regulatory frameworks and responsible deployment practices.
How is biometric identification regulated by the AI Act?
The application of real-time remote biometric identification in publicly accessible areas (such as facial recognition through CCTV) for law enforcement purposes is restricted, except when employed in the following scenarios:
1. Law enforcement activities associated with 16 specified crimes.
2. Targeted searches for specific victims, abduction, trafficking, sexual exploitation of individuals, and missing persons.
3. Prevention of threats to life or physical safety, or response to the current or foreseeable threat of a terrorist attack.
The list of the 16 crimes includes:
· Terrorism
· Trafficking in human beings
· Sexual exploitation of children and child sexual abuse material
· Illicit trafficking in narcotic drugs and psychotropic substances
· Illicit trafficking in weapons, munitions, and explosives
· Murder
· Grievous bodily injury
· Illicit trade in human organs and tissue
· Illicit trafficking in nuclear or radioactive materials
· Kidnapping, illegal restraint, and hostage-taking
· Crimes within the jurisdiction of the International Criminal Court
· Unlawful seizure of aircraft/ships
· Rape
· Environmental crime
· Organized or armed robbery
· Sabotage, participation in a criminal organization involved in one or more crimes listed above.
The real-time remote biometric identification carried out by law enforcement authorities requires prior authorization from a judicial or independent administrative authority, and the decision is binding. In cases of urgency, authorization can be granted within 24 hours; if rejected, all data and output must be deleted.
Before implementation, a fundamental rights impact assessment is mandatory, and notification to the relevant market surveillance authority and the data protection authority is required. In urgent situations, the system may be used without registration.
The use of AI systems for post-remote biometric identification (identifying individuals in previously collected video material) of persons under investigation necessitates prior authorization from a judicial authority or an independent administrative authority. Additionally, notification to the data protection and market surveillance authority is mandatory.