Facial Recognition Policies Get a Face Lift with EU AI Act
15 November 2023
Facial recognition systems are widely employed across the world today. The use of facial recognition systems brings real public safety benefits such as apprehending criminals and maintaining law and order. However, their proliferation also raises concerns about fundamental rights and privacy. The EU AI Act has sought to impose strict restrictions on the use of facial recognition in public spaces. Could this be a model for others to emulate?
The advent of artificial intelligence (AI) is driving the use of biometric technologies, including facial recognition which are being widely used around the world today. Private and government actors alike have been increasingly employing facial recognition systems for verifying, identifying and categorising individuals. These systems work by characterising an individual’s unique facial features and expressions from images and videos to verify their identity.
The benefits of facial recognition have made it indispensable for security purposes. Moreover, the market for facial recognition has been slated to hold significant growth potential over the next few decades. In this background, the use of facial recognition technologies and their implications have become a prominent topic of discussion within policy and public spheres.
The use of facial recognition systems brings real public safety benefits such as apprehending terrorists and criminals and help maintain law and order. On the other hand, their proliferation, privacy-invading and error-prone nature raise concerns about fundamental rights, such as discrimination against certain segments of the population. Their potential to violate the violation of the right to data protection and privacy also remains a concern.
While countries like China, the United States and Australia have widely integrated facial recognition into their law enforcement and national security apparatus, the European Union (EU) appears to be taking a slightly different approach. The European Parliament has prohibited the use of “abusive surveillance systems” including facial recognition in public spaces. This article examines the practicality of such a ban, in the context of balancing the risks and benefits of employing facial recognition.
What Are The Advantages?
Facial recognition is promoted as something that will make our lives more convenient at a personal level. Especially in public spaces, the advent of facial recognition has rendered security management rather seamless. In Osaka, Japan, for instance, four train stations have introduced facial systems that let people through without a ticket or ID by recognising their faces. A transport ministry official said they would "emphasise as an advantage the fact that passengers with large luggage can pass through the lockers by simply showing their faces instead of looking for a ticket."
Facial recognition in this way bolsters security. The use of biometrics, including facial scans are said to provide a higher level of assurance and verification in general. This helps reaffirm that a person attempting to access a service or conduct a transaction actually exists. Biometrics advocates point out that passwords, PINs and other personal identification information can be compromised through data breaches to allow fraudsters to access accounts that use traditional authentication methods. In contrast, it is difficult for someone other than yourself to provide your facial scan on the spot. When it comes to law enforcement, supporters of facial recognition argue that it will make it easier for police to track down suspects.
And The Disadvantages?
Facial recognition violates human rights and individual freedoms in more ways than one. First, technology intrusively gains access to some of our most intimate data. Such intimate data without express consent from an individual. An individual has no control over how the data is handled or used afterwards. There also remains a chance that the data may be stored in databases which are not properly secured. The widespread deployment of facial recognition systems may further work towards stifling dissent owing to individuals’ fear of being identified. Such fear may discourage individuals from participating in gatherings or protests which they otherwise would have engaged with.
The error-prone nature of facial recognition systems may aggravate gender and racial discrimination and pose dangers to inclusivity in societies. While the technology can better identify white males, it has been noted to have a higher rate of errors with respect to people of colour, particularly women of colour. would make it difficult for racial and gender minorities to access various services. Employment of facial recognition in this context adds yet another barrier to these already marginalised groups. In this way, it may widen the existing inequalities in society.
Moreover, facial recognition systems may become a tool of abuse if used in a discriminatory manner. For instance, facial recognition has been disproportionately employed against people of colour in law enforcement systems in countries including the USA and Italy. In Italy, for example, the police facial recognition software database contained 2 million images of Italians, compared to 7 million images of refugees and migrants. So the way this technology is being used is likely to further reinforce the way people from certain groups are already being disproportionately targeted.
Facial Recognition Regulation in the EU
To address such impacts, the EU already has strict rules in place under the Charter of Fundamental Rights, the General Data Protection Regulation, the EU Directive Data protection in law enforcement and the EU legal framework on non-discrimination. These laws also apply to procedures and activities related to facial recognition technologies. However, various stakeholders are questioning the effectiveness of the current EU legal framework in terms of its adequate handling of fundamental rights concerns raised by facial recognition technology.
Even if courts try to close gaps in the protection of the to exclude fundamental rights, legal uncertainty and confusion would remain. Against this background, the EU AI Act adopted in June 2023, aims to limit the use of biometric recognition systems, including facial recognition, which could lead to widespread surveillance. In addition to existing legislation, the AI Act introduces new rules for the use of facial recognition technologies in the EU and to distinguish whether their use constitutes a “high “ or “low” risk.
Numerous facial recognition technologies would be classified as high-risk and would be banned or comply with strict requirements. The use of real-time facial recognition systems in public spaces for law enforcement purposes would be prohibited unless member-states decide to authorize their use for important reasons of public security and are authorized by a judicial or administrative authority. Conformity assessments and safety requirements are also to be met for employing facial recognition in public spaces for purposes other than law enforcement. Failing to comply with the same, these systems will be deemed ineligible “to be placed on the market”. Meanwhile, systems classified as low-risk are only subject to limited transparency requirements.
Can EU Lead The Conversation?
Facial recognition may seem attractive because it can simplify our lives and increase public safety. But it is more likely to prove to be a major inconvenience, making it easier to take away our freedoms and choices and increase inequality and discrimination. It is becoming increasingly popular with governments, so the law needs to catch up and prevent this technology from even being used in most contexts.
Taking an approach rooted in risk, voices against facial recognition have become stronger in Europe. While stakeholders, researchers and regulators appear to agree that there is a need for regulation, some critics question the proposed distinction between high and low-risk biometric systems. They warn that the proposed legislation would enable a system of standardization and self-regulation without adequate government oversight. They are calling for a change to the AI Act, including with regard to the flexibility of the member-states in implementing the new regulations. Some strongly support stricter regulations, including a complete ban on such technologies.
Looking beyond the EU's borders, there are very few legally binding regulations on facial recognition technologies to date. Policymakers around the world have the opportunity to engage in multilateral and possibly bilateral deliberations about how to establish appropriate controls for the use of facial recognition systems. EU can potentially take up the charge of initiating these conversations.
Disclaimer: The article expresses the author’s views on the matter and do not reflect the opinions and beliefs of any institution they belong to or of Trivium Think Tank and the StraTechos website.
Tobias is the resident European Affairs Fellow for Trivium Think Tank's StraTechos website. He holds a dual masters (M.A./M.Sc.) in European Studies from the Universities of Münster (Germany) and Twente (Netherlands). He has previously worked as an Assistant Lecturer at the Manipal Center for European Studies, MAHE, Manipal, India.