Remote Biometric Identification and Emotion Recognition in the Context of Law Enforcement From the AI Regulation Proposed by the Commission to the EU Co-Legislators’ Positions

• Date: 12 October 2023
• Author: Prof. Dr. Vagelis Papakonstantinou,Evangelos Zarkadoulas
• DOI: https://doi.org/10.30709/eucrim-2023-021
• Pages: 131

I. Introduction

Recently, artificial intelligence (AI) has been a top-agenda item worldwide. Rapid and ongoing technological advances in AI have triggered legislative initiatives to regulate its use in Europe. In April 2021, the European Commission tabled a proposal for a Regulation laying down harmonised rules on artificial intelligence across the EU.¹ It is based on Art. 114 of the Treaty on the Functioning of the European Union (TFEU), conferring upon the EU competence for the single market, in conjunction with Art. 16 TFEU, providing for legislation on the protection of individuals in the context of the processing of their data. Consequently, this proposal is a horizontal legislative act addressing the function of the internal market whilst also covering the field of law enforcement. A key feature of this proposal is that the Commission has adopted a risk-based approach for classifying AI applications into four categories: prohibited practices, high risk with robust requirements, medium-low risk with transparency obligations, and minimal-no risk without rules.²

Law enforcement has been mainly classified under high-risk systems. This decision by the Commission raised concerns in the police community. At the Justice and Home Affairs Council in June 2021, some Member States suggested that a separate legal text on the use of AI by law enforcement authorities be adopted.³ Their arguments related to the special nature of the police sector and the method followed in setting up the EU personal data protection framework consisting of the General Data Protection Regulation (GDPR) and the Directive 2016/680 (the Law Enforcement Directive). Undoubtedly, the monopoly on legitimate violence distinguishes law enforcement authorities from the remainder of public administration, as the former are responsible for public security and contribute to national security in the field of counter terrorism. What is more, discipline and implementation of criminal law are fundamental elements of the police remit. However, due to the limited support by other Member State delegations in the Council, the Commission’s proposal was ultimately backed in its original wording.

The following sections provide an overview of the institutions’ positions on remote biometric identification and emotion recognition tools. First and foremost, the article presents the relevant provisions of the Commission’s proposal (Section II.). Subsequently, Sections III. and IV. outline the opinions of the Council of the EU and the European Parliament, and how these differ. In conclusion, the article highlights how the Commission and the Council have been able to strike a balance between law enforcement needs and fundamental rights – unlike the European Parliament, which has adopted a problematic angle when it comes to law enforcement.

II Remote Biometric Identification and Emotion Recognition AI Systems in the Commission Proposal

Two of the Regulation’s components that have attracted significant attention during the discussions in the European Parliament and the Council are remote biometric identification and emotion recognition. The Commission has proposed categorising real-time remote biometric identification in public spaces for law enforcement purposes as a prohibited practice unless substantive and procedural prerequisites apply (Art. 5 of the proposal). With regard to these substantive requirements, the Commission has proposed that the use of this technology must pursue one of the following objectives: a) search for potential crime victims, for example, missing minors; b) prevention of threats to the life and physical safety of individuals or a terrorist incident; or c) detection, identification, or prosecution of a perpetrator or a suspect of a criminal offence referred to in Art. 2(2) Council Framework Decision on the European Arrest Warrant, and punishable with at least three years of a custodial sentence or a detention order under the rules of the Member State concerned. In terms of national procedures, prior authorisation by a judicial or an independent administrative authority is deemed necessary. Nevertheless, the proposal also provides for such authorisation being sought during an operation or ex-post in case of emergency.

Notwithstanding that Art. 5 of the Commission proposal allows real-time at a distance biometric recognition, Annex III defines it as a high-risk AI tool, and the conditions set out for high-risk AI applications must be met. In particular, these requirements include a risk management system, data governance, technical documentation, record-keeping, transparency, human oversight and accuracy, robustness, and cybersecurity (Arts. 8-15 of the proposal).

Annex III also classifies post biometric...